DOT/FAA/AR-03/72 

Office of Aviation Research 

Washington, D.C. 20591 

Indications of Propulsion System 

Malfunctions 

November 2004 

Final Report 

This document is available to the U.S. public 

through the National Technical Information 

Service (NTIS), Springfield, Virginia 22161. 

U.S. Department of Transportation 

Federal Aviation Administration
NOTICE 

This document is disseminated under the sponsorship of the U.S. 

Department of Transportation in the interest of information exchange. The 

United States Government assumes no liability for the contents or use 

thereof. The United States Government does not endorse products or 

manufacturers. Trade or manufacturer's names appear herein solely 

because they are considered essential to the objective of this report. This 

document does not constitute FAA certification policy. Consult your local 

FAA aircraft certification office as to its use. 

This report is available at the Federal Aviation Administration William J. 

Hughes Technical Center’s Full-Text Technical Reports page: 

actlibrary.tc.faa.gov in Adobe Acrobat portable document format (PDF). 
 Technical Report Documentation Page

1. Report No.

DOT/FAA/AR-03/72

2. Government Accession No. 3. Recipient's Catalog No.

 4. Title and Subtitle 

INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS 

5. Report Date

November 2004

6. Performing Organization Code

7. Author(s)

S.T. Clark, R.E. Iverson, R.J. Mumaw, J.A. Sikora, J.L. Vian, and V.J. Winters

8. Performing Organization Report No. 

CDRL Item 3c 

9. Performing Organization Name and Address

The Boeing Company 

P.O. Box 3707

10. Work Unit No. (TRAIS)

Seattle, WA 98124 11. Contract or Grant No.

DTFA03-01-C-00032

12. Sponsoring Agency Name and Address

U.S. Department of Transportation 

Federal Aviation Administration

13. Type of Report and Period Covered

Final Report 

09/25/01 through 12/31/02

Office of Aviation Research 

Washington, DC 20591

14. Sponsoring Agency Code

ANE-100, ANM-100 

15. Supplementary Notes

The FAA William J. Hughes Technical Monitor was William Emmerling.

16. Abstract

This report summarizes the concepts, risks, issues, and conclusions of efforts to assess technical feasibility and operational 

appropriateness of providing indications of propulsion system malfunctions. 

17. Key Words 

Propulsion system malfunction, Inappropriate crew response

18. Distribution Statement 

This document is available to the public through the National 

Technical Information Service (NTIS), Springfield, Virginia 

22161. 

19. Security Classification (of this report) 

 

 Unclassified 

20. Security Classification (of this page) 

 Unclassified

21. No. of Pages 

 257

22. Price

Form DOT F 1700.7 (8-72) Reproduction of completed page authorized
ACKNOWLEDGEMENTS 

This study involved a large and diverse group of individuals and organizations. The following 

individuals, in particular, are acknowledged for their participation, work, and support: 

The Boeing Company: Sam Clark, John Doherty, Jenny Gertley, Gene Iverson, Allen John, Joe 

MacDonald, Jay Mesick, Randy Mumaw, Bob Myers, Joel Purificacion, James Johnson, Eric 

Schwartz, Joe Sikora, Doug Swanson, Dennis Tilzey, Nasser Vaziri, John Vian, and Van Winters 

General Electric: Sarah Knife, Stephen Bitter, and Pete Toot 

Federal Aviation Administration: Don Altobelli, Ann Azevedo, Bill Emmerling, Gary Horan, 

Mike McRae, and Hals Larsen 

Impact Technologies: Greg Kacprzynski, and Mike Roemer 

Pratt & Whitney: William Cousins, Scott Carr, and Art Becker 

United Air Lines: Marilyn Hardy 

iii/iv
TABLE OF CONTENTS 

Page 

EXECUTIVE SUMMARY xix 

1. INTRODUCTION AND APPROACH 1-1 

1.1 Introduction 1-1 

1.2 Approach 1-1 

2. DISCUSSION, SUMMARY AND CONCLUSIONS, AND 

RECOMMENDATIONS 2-1

2.1 Discussion 2-1 

2.2 Summary and Conclusions 2-2 

2.3 Recommendations 2-3 

3. OVERALL PSM DETECTION AND ANNUNCIATION RISK/BENEFIT

ASSESSMENT (TASK 1.3) 3-1 

3.1 Terms and Definitions 3-1 

3.2 Benefit/Risk Assessment of PSM Annunciations 3-4 

3.3 General Operational Benefit and Risks of PSM Annunciation 3-4 

3.4 Potential Operational Benefit of PSM Annunciation 3-4 

3.5 Operational Risks of PSM Annunciation 3-5 

3.6 General Detection Feasibility Considerations 3-5 

3.6.1 Identification of Malfunctioning Engine 3-5 

3.6.2 Detection Time Lag Rule 3-6 

3.6.3 Recoverability/Nonrecoverability 3-6 

3.6.4 Detection Feasibility 3-6 

3.6.5 False Detection Risk Discussion 3-7 

3.6.6 Failure to Detect Risk Discussion 3-7 

3.6.7 Recoverability Research Recommendations 3-7 

3.7 Powerloss Annunciation Potential Operational Benefits/Risks 3-8 

3.7.1 Powerloss Annunciation Potential Benefits 3-8 

3.7.2 False Powerloss Detection Risks 3-8 

3.7.3 Failure to Annunciate/Detect Powerloss Risks 3-9 

3.7.4 Confidence of Correct Powerloss PSM Detection 3-9 

3.7.5 Powerloss Detection Further Research 3-10 

3.8 Surge Annunciation Potential Operational Benefits and Risks 3-10 

v
3.8.1 Surge Annunciation Potential Benefits 3-11 

3.8.2 Surge Detection/Annunciation Risks 3-11 

3.8.3 Confidence of Correct Surge PSM Detection 3-12 

3.8.4 Surge Detection Further Research 3-13 

3.9 Failed Fixed Thrust Annunciation Potential Operational Benefits and Risk 3-13 

3.9.1 Failed Fixed Thrust Annunciation Potential Benefits 3-13 

3.9.2 Failed Fixed Detection/Annunciation Risks 3-14 

3.9.3 Confidence of Correct Failed Fixed Thrust PSM Detection 3-14 

3.9.4 Failed Fixed Thrust Further Research 3-15 

3.10 High Vibration Annunciation Potential Operational Benefits and Risks 3-15 

3.10.1 High Vibration Annunciation Potential Operational Benefits 3-15 

3.10.2 High Vibration Detection/Annunciation Risks 3-15 

3.10.3 Confidence of Correct High Vibration PSM Detection 3-16 

3.10.4 High Vibration Further Research 3-16 

3.11 Thrust Asymmetry 3-17 

3.11.1 Thrust Asymmetry Annunciation Potential Benefits and Risks 3-17 

3.11.2 Confidence of Correct Thrust Asymmetry PSM Detection 3-18 

3.12 The PSM Benefit, Detection Potential, and Risk Summary 3-18 

4. OPERATIONAL ASSESSMENT—TASKS 2.1, 1.2, 6.2, AND 6.1 4-1 

4.1 In-Service Data Assessment (Task 2.1) 4-1 

4.1.1 Research Objective and Goal 4-1 

4.1.2 Task 2.1 Overview and Background 4-1 

4.1.3 Discussion of Inappropriate Crew Response 4-3 

4.1.4 Task 2.1 Review and Analysis Methodology 4-4 

4.1.4.1 The AIA PSM+ICR Report Data Review and Analysis 4-4 

4.1.4.2 The PSM and IFSD Data Review 4-5 

4.1.5 The Review and Analysis of AIA PSM+ICR Report Events 4-6 

4.1.5.1 The PSM+ICR Report Events Overview 4-6 

4.1.5.2 The PSM+ICR Category Characterizations and Related 

Conclusions 4-6

vi
4.1.5.3 The AIA PSM+ICR Report Event Analyses and Related 

Conclusions 4-10

4.1.5.4 General and Specific PSM+ICR Safety Concerns From

Event Analyses 4-22 

4.1.6 Review and Analysis of Post-AIA Report PSM, IFSD, and 

PSM+ICR Data 4-25 

4.1.6.1 Propulsion System Malfunction Data 4-25 

4.1.6.2 Post-AIA Report PSM+ICR Events on Boeing Aircraft 4-33 

4.1.6.3 The AIA Report PSM+ICR and 2000-2001 PSM Data 

Comparison/Analysis 4-35

4.1.6.4 Post-AIA Report Data Summary, Calculations, and 

Comments 4-38

4.1.7 Task 2.1 Report Conclusions and Recommendations 4-40 

4.1.7.1 General 4-40 

4.1.7.2 Traceability Task 2.1 Conclusions and 

Recommendations 4-43

4.2 Operational Assessment of PSM Annunciations (Task 1.2) 4-44 

4.2.1 Engine Indication and Crew-Alerting Systems 4-44 

4.2.2 Engine Indication System 4-46 

4.2.2.1 Engine Indications 4-46 

4.2.2.2 Engine Indication Annunciations/Alerts 4-49 

4.2.3 Crew-Alerting Systems 4-51 

4.2.3.1 General 4-52 

4.2.3.2 Engine Indication and Crew-Alerting System Alert 

Levels 4-52

4.2.3.3 Engine Indication and Crew-Alerting Systems Inhibits 4-53 

4.2.4 Flight Deck Design and Operational Philosophy, Requirements, 

and Guidelines 4-54 

vii
4.2.4.1 Flight Deck Design and Operational Philosophy 4-54 

4.2.4.2 Flight Deck Interface Design Guidelines and 

Requirements 4-55

4.2.4.3 Applicable Federal Aviation Regulations 4-56 

4.2.5 Operational Assessment 4-57 

4.2.5.1 Safety Concerns and Focus—Task 2.1 Data Analysis 4-58 

4.2.5.2 Inappropriate Crew Response Prevention Potential 4-61 

4.2.5.3 Existing Indications, Alerts, and Functions PSM+ICR 

Prevention Potential 4-66 

4.2.6 Desired/Required Crew Awareness and Response—Potential 

Annunciations 4-72

4.2.6.1 Potential Safety and Operational Benefits and Risks 4-73 

4.2.6.2 Summary, Conclusions, and Preliminary 

Recommendations 4-81

4.3 Human Factors Considerations (Task 6.2) 4-85 

4.3.1 Introduction 4-85 

4.3.2 Engine-Related Flight Crew Tasks 4-86 

4.3.2.1 Engine Performance Monitoring 4-86 

4.3.2.2 Crew Engine Health Monitoring (and Managing 

Nonnormals) 4-87

4.3.3 Enhancement Opportunities for Current Indications 4-87 

4.3.3.1 Detection of Change 4-88 

4.3.3.2 Interpretation of Change 4-89 

4.3.3.3 Thrust Indication 4-91 

4.3.3.4 Accident/Incident Literature 4-92 

4.3.4 Role of the Flight Deck Interface in Propulsion System

Management 4-93

4.3.4.1 Supporting Performance Monitoring 4-93 

viii
4.3.4.2 Supporting Monitoring Engine Health and Managing 

Nonnormals 4-95

4.3.5 Designing for Engine-Related Tasks 4-96 

4.3.5.1 Level of Representation 4-97 

4.3.5.2 Level of Support From the Flight Deck Interface 4-99 

4.3.5.3 Allocation Guidelines: Human Processor Strengths and 

Weaknesses 4-107

4.3.6 Indication Ideas 4-114 

4.3.7 Summary and Recommendations 4-117 

4.4 Noncommercial Aircraft Technology Survey (Task 6.1) 4-120 

4.4.1 Task 6.1 Objective and Goal 4-120 

4.4.2 Task 6.1 Overview/Background and Methodology 4-121 

4.4.3 Aircraft and Engine Descriptions 4-123 

4.4.3.1 F15E 4-123 

4.4.3.2 F18E/F 4-123 

4.4.3.3 F22 4-124 

4.4.3.4 AV8B 4-124 

4.4.3.5 C17 4-124 

4.4.3.6 V22 4-125 

4.4.3.7 AH64D 4-126 

4.4.3.8 Gulfstream V 4-126 

4.4.4 Summary of Survey Results 4-126 

4.4.5 Potential Precedent and Technology Transfers 4-126 

4.4.5.1 Engine Indication Concepts 4-129 

4.4.5.2 Propulsion System Malfunction Indication 

Annunciations 4-129

4.4.5.3 Propulsion System Malfunction Alert Annunciations 4-129 

4.4.5.4 Display Management Concepts 4-130 

4.4.5.5 Airplane-Level Information Display 4-130 

4.4.5.6 Health Monitoring and Control 4-130 

ix
4.4.5.7 Airplane Flight Control or Control Function 4-130 

4.4.6 Task 6.2 Conclusions 4-131 

4.4.7 Task 6.2 Recommendations 4-131 

5. TECHNICAL FEASIBILITY ASSESSMENT 5-1 

5.1 Propulsion System Malfunction Characterization 5-2 

5.1.1 Propulsion System Malfunction Categories From Existing Data 5-4 

5.1.1.1 Characterization of PSM Events Resulting in ICR 5-4 

5.1.1.2 Characterization of Indicated and Monitored Parameters 5-5 

5.1.1.3 Nonrecoverable Surge 5-8 

5.1.2 Propulsion System Malfunction Event Characterization Data 5-8 

5.1.3 Data Sets Used for Analysis of PSM Surge Events 5-9 

5.1.3.1 Required Parameters 5-9 

5.1.3.2 Surge Detection and Recoverability 5-9 

5.2 Feasibility Assessment of Detection Methods 5-10 

5.2.1 Feasibility Assessment Technical Expert Feedback 5-10 

5.2.2 Feasibility Assessment From Engine OEM Technical Expert 

Feedback 5-12

5.2.3 Feasibility Assessment From Task 5.2 Analysis 5-12 

5.3 Simulator Evaluation and Requirements 5-13 

5.3.1 Overview 5-13 

5.3.2 Task 6.3 Background and Methodology 5-13 

5.3.3 The PSM Annunciation Simulator Research Evaluation 

Requirements 5-14

5.3.4 Research Issues/Questions 5-14 

5.3.5 Test Objectives 5-14 

5.3.6 Test Experimenter(s) and Facility 5-14 

x
5.3.7 Malfunctions 5-15 

5.3.8 Propulsion System Malfunction Annunciation Test Concepts 5-15 

5.3.9 Pilot Test Subjects/Evaluators 5-15 

5.3.10 Preliminary Experimental Design 5-16 

5.3.11 Malfunction Test Scenario Matrix 5-16 

5.3.12 Data Collection, Analysis, and Reporting 5-17 

5.3.12.1 Objective Data Collection, Analysis, and Reporting 5-17 

5.3.12.2 Subjective Data Collection, Analyses, and Reporting 5-17 

5.3.12.3 Test Data Analysis 5-18 

6. BIBLIOGRAPHY 6-1 

7. RELATED DOCUMENTS 7-1 

APPENDICES 

A—Propulsion System Malfunction and Inappropriate Crew Response Data Analysis

Summary

B—Human Factors Framework

C—Human Factors Guidance on Flight Deck Design

D—Propulsion System Malfunction Characterization Data

E—Technical Feasibility Engineering Study

F—Airplane Engine Indications

G—Flight Deck Design and Operational Philosophy

xi
LIST OF FIGURES 

Figure Page 

1-1 Program Task Plan 1-2

4-1 The AIA Report Propulsion System Malfunctions 4-12 

4-2 The AIA Report Crew Response Category and PSM 4-12 

4-3 2000 and 2001 Propulsion System Malfunctions 4-27 

4-4 Surge Recoverability and IFSD Analysis 4-28 

4-5 Engine Powerloss/Failure Analysis 4-29 

4-6 2000 and 2001 IFSD Analysis 4-30 

4-7 1995-2001 IFSD Restart Analysis 4-32 

4-8 The AIA Report PSM+ICR Versus 2000 and 2001 PSM Event Data 4-36 

4-9 B777 Flight Deck Layout 4-44 

4-10 B777 EICAS Display Format 4-45 

4-11 B777 Primary Engine Indications 4-47 

4-12 B777 Secondary Engine Indications 4-48 

4-13 Engine/Fuel Display for a C-130 4-98 

4-14 C-130 Engine/Fuel Display With System Fault 4-100 

4-15 The E-MACS Display 4-101 

4-16a The E-MACS and Traditional Engine Indications—Normal Power-Up 4-102 

4-16b The E-MACS and Traditional Standard Engine Indications 4-102 

4-17 Examples of Parameter Indications Showing History 4-115 

4-18 Parameter Indications Showing History With the Round-Dial Format 4-115 

4-19 Example of a Difference Indication, Vertical Bar Format 4-116 

4-20 Example of a Difference Indication, Vertical Arrow Format 4-116 

4-21 Example of a Difference Indication, Horizontal Format 4-116 

5-1 Engine Analysis Parameter Set 5-9 

5-2 B777 Engineering Cab 5-15 

xii
LIST OF TABLES 

Table Page 

4-1 Crew Intent—Shutdown Good Engine 4-9 

4-2 Rejected Takeoff Point Relative to V1, Rotation, and Liftoff 4-10 

4-3 Crew Response, Malfunctions, Hazard, and PSM Recoverability 4-11 

4-4 Propulsion System Malfunction Recoverability 4-13 

4-5 Number of Crew and Number of Events Versus Number of Engines on Aircraft 4-14 

4-6 Events Versus Engine Type 4-14 

4-7 The AIA PSM+ICR Report Surge Events Recoverability 4-15 

4-8 Powerloss Recoverability 4-15 

4-9 Flight Phase, Altitude, Power, and Event Correlations 4-16 

4-10 Flight Phase, Altitude, PSM Symptom, and Hazard Correlation 4-16 

4-11 Event Category Versus Flight Phase 4-17 

4-12 Significant Thrust Asymmetry vs Flight Phase, PSM Symptom, and Hazard 4-18 

4-13 Significant Thrust Asymmetry vs Crew Response 4-18 

4-14 Crew Error Classification Versus HF Events 4-21 

4-15 2000 and 2001 Propulsion System Malfunctions 4-26 

4-16 Surge Recoverability and IFSD Analysis 4-28 

4-17 Engine Powerloss/Failure Analysis 4-29 

4-18 2000 and 2001 IFSD Analysis 4-30 

4-19 1995-2001 IFSD Restart Analysis 4-32 

4-20 Relative Ranking of AIA PSM+ICR and 2000-2001 PSM Event Data 4-35 

4-21 The PSM and PSM+ICR Frequency and Probability of HF, H, S, or I Event 4-37 

4-22 The PSM and PSM+ICR Frequency and Conditional Probability of HF or H Event 4-37 

4-23 The AIA Report Versus Post-AIA Report PSM+ICR Rates 4-40 

4-24 Cross-Model Engine Indication and Crew-Alerting Systems 4-46 

4-25 Inappropriate Crew Responses to PSMs and Associated Safety Data 4-59 

4-26 Inappropriate Crew Responses to PSMs and Associated Events 4-60 

4-27 Estimated ICR Prevention Potential—AIA Report HF and H Events 4-63 

4-28 Estimated ICR Prevention Potential—12 AIA Report HF Events 4-63 

4-29 Estimated ICR Prevention Potential—11 AIA Report H Events 4-63 

4-30 Combined ICR Prevention Potential—23 AIA Report HF and H Events 4-64 

4-31 Estimated ICR Prevention Potential—AIA Report S and I Event Types 4-65 

4-32 Estimated ICR Prevention Potential—AIA Report S and I Events 4-66 

4-33 Estimated ICR Prevention Potential—Post-AIA Report Events 4-67 

4-34 Estimated ICR Prevention Potential—Post-AIA Report Event Types 4-67 

4-35 Potential Benefit, Effectiveness, and Risk of New Annunciation/Alert 4-80 

4-36 Task 2.1 Report PSM Surge Event Data 4-80 

4-37 The AIA Report PSM+ICR and 2000-2001 Surge Event Data 4-81 

4-38 Survey Aircraft Normal Engine Parameter Indications Summary 4-127 

4-39 Survey Aircraft Nonnormal Annunciations Summary—Indications and Alerts 4-128 

5-1 Moments of Inertia for Engine Classes 5-6 

5-2 Representative Engine Coefficients 5-6 

5-3 Event Data for Analysis 5-8 

xiii
5-4 The PSM+ICR Events With Data Plots 5-8 

5-5 The PSM Annunciation Test Concept Versus Malfunction Matrix 5-16 

5-6 Flight Phase Versus Propulsion System Malfunction Matrix 5-17 

xiv
LIST OF ACRONYMS 

AB Afterburner 

AC Advisory Circular 

AECMA European Association of Aerospace Industries 

AGL Above Ground Level 

AH Abstraction Hierarchy 

AIA Aerospace Industries Association 

ATC Air Traffic Control 

BAP Bank Angle Protection 

BCA Boeing Commercial Airplane 

CAS Crew-Alerting System(s) 

CAST Commercial Aviation Safety Team

CFIT Controlled Flight Into Terrain 

CFMI CFM International 

CR Crew Response 

CRM Crew Resource Management 

CRT Cathode Ray Tube 

DBE Design by Exception 

DECS Digital Engine Control System

EEC Electronic Engine Control 

EGT Exhaust Gas Temperature 

EICAS Engine Indication and Crew-Alerting System

E-MACS Engine Monitoring and Control System

EPR Engine Pressure Ratio 

FAA Federal Aviation Administration 

FADEC Full Authority Digital Engine Control 

FAR Federal Aviation Regulations 

FPMU Fuel Pump Metering Unit 

GE General Electric 

H Hull Loss Without Fatalities 

HBPR High By-Pass Ratio 

HF Hull Loss With Fatalities 

HP High Pressure 

I Incident or Incidental 

ICR Inappropriate Crew Response 

IFSD In-Flight Shut Down 

KB Knowledge-Based 

L/O Liftoff 

LBPR Low By-Pass Ratio 

LOC Loss of Control 

LP Low Pressure 

MCL Master Caution Light 

MCP Mode Control Panel 

MFD Multifunction Display 

MWB Modern Wide Body 

xv
MWL Master Warning Light 

N1 Engine Fan Speed (Low Pressure Compressor and Last Stage Turbine Speed) 

N2 Engine Core Speed (High Pressure Compressor and First Stage Turbine Speed) 

N3 Engine High Core Speed (RR Only) 

ND Navigation Display 

NR Nonrecoverable 

OEM Original Equipment Manufacturer 

Ops Operations 

P Pressure 

PDC Performance Data Computer 

PF Pilot Flying 

PFD Primary Flight Display 

PIC Pilot-In-Command 

PM Pilot Monitoring 

PNF Pilot Not Flying 

PP Prevention Potential 

PPP Policy, Procedures, and Practices 

PRGB Proprotor Gearbox 

PS Propulsion Systems 

PSD Propulsion Safety Division 

PSM Propulsion System Malfunction 

PW Pratt & Whitney 

R Recoverable 

R&D Research and Development 

RB Rule-Based 

rpm Revolutions per minute 

RR Rolls Royce 

RTO Rejected Take Off 

S Substantial Damage 

SB Skill-Based 

SDGE Shutdown Good Engine 

SDTGE Shutdown/Throttled Good Engine 

SIG Simulator Issues Group 

SOP Standard Operating Procedure 

T Temperature 

T/O Takeoff 

TAC Thrust Asymmetry Compensation 

TAT Total Air Temperature 

TBD To Be Developed/Determined 

TBV To Be Verified or To Be Validated 

TCAS Traffic Collision Avoidance System

TGE Throttled Good Engine 

TLA Thrust Lever Angle 

TRA Throttle Position 

xvi
UCR Undesired Crew Response 

UNK Unknown 

USAF United States Air Force 

USMC United States Marine Corp 

V1 Takeoff Decision Speed 

xvii/xviii
EXECUTIVE SUMMARY

Currently, a propulsion system malfunction (PSM) occurs about once every 20,000 flights on 

Western-built commercial transport turbojet aircraft. Historically, on such aircraft, PSM plus 

inappropriate crew response (ICR) events number two to three per year in revenue service. From

1958 to 1995, a PSM+ICR event occurred about once every 4 million flights, and a fatal 

PSM+ICR event occurred about once every 26 million flights. Partly in response to industry 

recommendations, the Federal Aviation Administration sponsored a follow-on study of 

PSM+ICR events to investigate and report the potential benefit of malfunction annunciations. 

This report documents the results of that study. 

Aircraft incidents and accidents involving ICR are associated primarily with unannunciated (i.e., 

no engine indication and crew alert system (EICAS) alert) PSMs. The primary PSMs associated 

with ICR are Powerloss, Surge, and Stuck Throttle. The ICRs that occur are Rejected Takeoff

Above V1 (go/no-go takeoff decision speed), Nonnormal Procedure Errors, Shutdown Good 

Engine, and Loss of Control. Typically, in PSM+ICR events, the crew does not initially 

recognize that a malfunction exists or is engine related, or does not correctly identify the 

malfunction or the affected engine, or does not correctly select or accomplish the appropriate 

nonnormal procedure. Most inappropriate crew responses to engine malfunctions, and nearly all 

fatal events, occur below 2000 feet in climb after takeoff or on approach and go-around. In some

cases, autopilot and autothrottle engagement compensate for powerloss, mask thrust asymmetry, 

and delay crew awareness. Autothrottle can cause loss of throttle position awareness, and 

throttle positions may not accurately indicate engine state or performance during engine 

malfunction. 

In general, a consistent contributing factor in PSM+ICR events is the lack of crew awareness of 

the existence, location, or type of the PSM, i.e., there is no clear, explicit indication or 

annunciation of the engine malfunction or the affected engine(s). In many cases, even when the 

crew is aware a malfunction exists, they are unaware that it is propulsion system related. High 

workload, limited time for analysis and assessment, autothrottle or autopilot engagement, and 

poor crew communication or resource management are often among the contributing factors. 

Loss of Control events account for the majority of fatal PSM+ICR events and most fatalities. 

Typically, loss of control involves a significant thrust asymmetry combined with loss of airspeed 

control and/or attitude control. These events primarily involve failure to control airspeed and 

attitude. The PSMs associated with fatal loss of control events are Powerloss and Stuck Throttle 

at low altitude in Climb, Descent, and Approach and Go Around phases of flight. In general, by 

the time the crew detects thrust asymmetry and attributes it to a PSM, the ICR has either 

occurred or is unavoidable, i.e., it is often too late to prevent the loss of control. The event data 

suggest that airspeed and attitude awareness and control have the greatest potential to prevent or 

mitigate loss of control events. The event data also suggest that explicit annunciation of Thrust 

Shortfall, Engine Failure, and annunciation of differences between engine Throttle Positions or 

Engine Speeds have potential to prevent or mitigate loss of control ICR events. 

Nonnormal Procedure Errors and Shutdown Good Engine events account for almost all the 

remaining fatal events and fatalities. Nonnormal Procedure Errors typically result from lack of 

xix
awareness of the specific PSM type, and involve failure to select or properly execute the 

appropriate nonnormal procedure. Shutdown Good Engine events on two engine aircraft 

typically result from lack of awareness of the affected engine, or a crew tendency to indict the 

engine at lowest power when presented with two engines at different power settings. The PSMs 

associated with these events are Powerloss and Surge at low altitude in Climb, Descent, and 

Approach phases of flight. Shutdown Good (i.e., nonmalfunctioning) Engine is of particular 

concern on two engine aircraft, but also of concern on three and four engine aircraft—

particularly when the good engine shutdown is on the same side as the malfunctioning engine. 

Explicit alert annunciations of Thrust Shortfall, Engine Failure, and Engine Surge have potential 

to prevent or mitigate nonnormal procedure and shutdown good engine ICR events. 

Malfunction annunciations have little or no potential to prevent Rejected Takeoff above V1 

(RTO>V1). Above V1, malfunction annunciations increase the risk of causing RTO>V1 events. 

Of all ICR types, RTO>V1 events have the least potential safety benefit. Historically, only one 

RTO>V1 event involved fatalities. That event involved three fatalities and the RTO occurred 

after liftoff. The RTO>V1 event data indicate that malfunction annunciations above V1 are a 

contributing factor in 27% of RTO >V1 events. This suggests that malfunction annunciation to 

prevent RTO>V1 could increase, not reduce, the risk of RTO>V1. Consistent with existing 

flight deck design and operational philosophy, inhibiting such annunciations from V1 to some

point after liftoff has greater potential for RTO>V1 prevention. 

Except for RTO>V1, the PSM+ICR event data suggest that explicit annunciations which identify 

the presence of a PSM, identify the affected engine(s), and identify the specific type of PSM, 

have potential for ICR prevention and risk mitigation. 

A Human Factors review and evaluation of the cognitive mechanisms involved in undesired 

crew response to propulsion system malfunctions was accomplished. Detection and 

interpretation tasks require substantial flight crew knowledge, effort, and time to identify and 

understand the malfunction and formulate an appropriate response. Consequently, detection and 

interpretation tasks increase the potential for crew error. Even when significant changes in 

airplane performance or engine parameters are detected, it can be very difficult to interpret or 

understand those changes and determine how to respond. Ideally the flight deck interface design 

and associated procedures should be as error proof as possible and aid the flight crew transition 

from malfunction detection to an appropriate response. The Human Factors review concluded 

that where a malfunction can be reliably detected, the crew should be alerted to the malfunction 

via a central alerting function such as EICAS, and also concluded that means should be provided 

for improving flight crew understanding of the malfunction at airplane system and mission 

levels. 

From 1958 to 2001, there were 12 fatal hull loss and 13 nonfatal hull loss PSM+ICR events in 

the Western commercial transport turbojet fleet over approximately 396 million flights—

typically involving powerloss, surge, or stuck throttle. Through 2001, the modern Boeing fleet 

(aircraft designed and certified in the 1980s and later, i.e., B-757/767 accumulated 

approximately 30 million flights, and is currently accumulating approximately 4 million flights 

per year. There are no PSM+ICR related hull loss without fatalities or hull loss with fatalities 

events in the modern Boeing fleet. Surge and powerloss are among the top PSMs currently 

xx
reported in service. PSM-related Nonnormal Procedure Errors, Shutdown Good Engine, and 

Loss of Control ICRs continue to occur in service. Analysis indicates that the potential for hull 

loss and fatal PSM+ICR within the modern fleet has been reduced through design improvements 

(primarily on newer aircraft), but still exists (primarily on older aircraft). 

PSM+ICR prevention potential is the estimated opportunity, through PSM annunciation, to 

prevent or mitigate inappropriate crew response by providing timely awareness, correct 

understanding, and linkage to the appropriate nonnormal procedure. Review of historical 

PSM+ICR hull loss with fatality events indicates that ICR prevention potential through 

malfunction annunciation appears to exist in 50% or more fatal events. Events with prevention 

potential account for 88% of all PSM+ICR fatalities. Prevention potential also exists in nonfatal 

ICR events. Prevention potential is associated primarily with alert annunciation of Powerloss, 

Surge, and Failed Fixed Thrust malfunctions. Note that these estimates of prevention potential 

are based on review of available, but often limited, data, and are judgments. Judgment of 

prevention potential indicates only that the opportunity for prevention appears to exist, and that 

prevention is a possibility, not a certainty. 

Detection capability and annunciation precedents exist for Powerloss (Thrust Shortfall and 

Engine Failure/Subidle), and between engine differences in Throttle Position and Engine Speeds 

(i.e., Throttle and N1 splits) on heritage Boeing aircraft. Validation that existing powerloss 

detection requirements address PSM+ICR is required for cross model implementation. 

Detection capability and annunciation precedents exist for Surge, but not on heritage Boeing 

aircraft. In general, propulsion experts agree that detection of surge is feasible. However, there 

are significant unresolved issues regarding development and validation of surge detection 

sensors and software. Development of surge detection requirements and demonstration and 

validation of reliable surge detection capability is required. 

This study had narrow and limited focus, investigation into the detection potential of PSM+ICR 

related PSMs, and the prevention potential of annunciating those PSMs. The study concluded 

that PSM annunciation has potential benefit. However, the benefit cannot be quantified with 

absolute certainty, and the feasibility of implementing the various malfunction annunciations has 

not been assessed. The comparative feasibility and effectiveness of PSM annunciations versus 

other alternative solutions should be assessed, and the advantages and disadvantages of available 

solutions should be understood, before any regulatory, implementation, or other action is taken. 

PSM+ICR events are understood with reasonable confidence. The challenge is to prevent very, 

very rare events—one fatal event every 26 to 33 million flights. For perspective, the entire 

modern Boeing fleet (717, MD-11, MD-90, 737NG, 757, 767, 747-400, and 777) had 

accumulated approximately 30 million flights through 2001. Indication, annunciation, and other 

improvements that address PSM+ICR have been implemented in the modern Boeing fleet, but 

gaps exist and PSM+ICR events still occur. Malfunction annunciations appear to offer 

PSM+ICR event prevention potential. Pilot qualification, training, policies, practices, and 

procedures also have prevention potential. However, PSM+ICR prevention is not certain or 

guaranteed. 

xxi
Work on PSM detection requirements, validation and demonstration that desired detection is 

possible, and assessment of implementation feasibility, remain to be done. The study 

recommends follow-on work to define PSM+ICR-related surge and powerloss detection 

requirements, validate and demonstrate desired surge and powerloss detection capability, and 

determine surge and powerloss detection and annunciation implementation feasibility.

xxii
1. INTRODUCTION AND APPROACH. 

1.1 INTRODUCTION. 

This report summarizes the concepts, risks, issues, and conclusions of efforts to assess technical 

feasibility and operational appropriateness of providing indications of propulsion system

malfunctions. The effort followed the technical approach, tasking, and schedule specified in the 

Propulsion System Malfunctions Program Plan (CDRL 3a) that was established to support the 

Federal Aviation Administration (FAA) in efforts to assess feasibility and appropriateness of

providing indications and annunciations of propulsion system malfunctions. 

1.2 APPROACH. 

An integrated product team approach was used to bring together the multiple technical disciplines 

needed to assess the feasibility and appropriateness of providing indications of propulsion system

malfunctions to flight crews. The overall goal was to answer questions concerning feasibility and 

appropriateness of propulsion malfunction indications, support Harmonization Terms of 

Reference 25.1305 committee efforts with useful data and information, and identify issues that 

should be emphasized in future research efforts. A task team was established consisting of Boeing

engineers and subcontractors with extensive commercial airplane operations and technology research 

experience. The team included members from Boeing Commercial Airplanes (BCA) Propulsion 

Technology, BCA Flight Deck Research, BCA Simulation Lab/Test, and Boeing Phantom Works 

Engineering and Information Technology organizations. This team met regularly with FAA team

members and Aviation Rulemaking Advisory Committee Powerplant Installation Harmonization 

Working Group representatives to facilitate flow of requirements and interim results. 

A technical approach was established to facilitate systematic technical progress and maximum

contribution by team member experts. The task breakdown and flow of technical activities for the 

program is shown in figure 1-1. The effort consisted of multiple technical paths that provided the 

essential information that was used to support the primary task of an overall assessment of the 

need, feasibility, risks, and known issues related to the implementation of propulsion malfunction 

indications and annunciations. An Operational Assessment path (highlighted in green) involved 

in-service data analysis and operational assessment of event information and summary reports to 

determine whether lack of annunciated information or presentation of annunciated information 

led to safety critical events. Critical types of propulsion malfunctions were identified and 

correlations made among factors present during the in-service incidents with a focus on defining 

and assessing annunciations to address the in-service incident scenarios. Issues related to current 

flight deck designs, crew response limitations, human factors, and lessons learned from previous 

programs were identified and considered throughout these efforts. A Technical Feasibility path 

(highlighted in red) provided for assessment of technical risk associated with surge, fail, and 

asymmetry detection. Technical experts and technical literature were used to make a high-level 

assessment concerning whether reliable detection (with respect to its intended use for indications) 

is feasible. Engine companies were approached to provide comments to this assessment. A final 

1-1
Summary and Conclusions path (highlighted in black) provided for aggregation of information 

from the feasibility and appropriateness task paths to achieve a balanced assessment of

opportunities and risk of approaches to address propulsion system malfunction (PSM) and 

inappropriate crew response (ICR) (PSM+ICR). 

Kickoff

Meeting

Dev. Draft

Program

Plan

Assess

Technical

Feasibility/Risk

Prepare

Progress

Reports

Deliverable 3c

Assess

Operational

Usefulness/Risk

Progress

Reports

Deliverable 3b

Final Report

Deliverable 3b

Draft

Final Report

Deliverable 3a

Program Plan

Develop

Program

Plan

Review Inservice data

& reports

Assess

Overall

Potential/Risk

1.3

recurring

Prepare

Draft Final

Report

Prepare

Final

Report

FAA

Comments

FAA Feedback

3.1

3.2

3.3

3.4

Malfunction

Physical

Characterization

Detection Methods, Engine Mfg.

Review/

Comments

Noncommercial

Technology

Usefulness

Simulator

Evaluation

Rqmts & Plan

Indications

Research

Indications

Demo

Deliverable 6.4

Demo

Data Acquisition,

Implementation Risk

Operational Usefulness Technical Feasibility Summary/Conclusions

Task Plan

5.1 5.2 1.1 5.3

1.2

2.1

6.1 6.3 6.2

6.4

FIGURE 1-1. PROGRAM TASK PLAN 

1-2
2. DISCUSSION, SUMMARY AND CONCLUSIONS, AND RECOMMENDATIONS. 

2.1 DISCUSSION. 

The Boeing has given considerable thought and discussion to the issue of PSM+ICR. It is 

important to note that this FAA contract had an intentionally narrow and limited focus 

investigation into the detection potential of PSM+ICR-related PSMs, and the prevention 

potential of annunciating those PSMs. This study concluded that PSM annunciation offers 

potential benefit, but that the benefit cannot be quantified with absolute certainty. Every effort 

was made to limit the potential for misinterpretation and over interpretation of the data, 

conclusions, and recommendations in this and accompanying reports. Nevertheless, given the 

quantity of data and complexity of the technical and operational issues, there is likely to be some

degree of misinterpretation and over interpretation of the study data and results. Follow-on 

efforts will be needed to correct any misinterpretation and over interpretation and to ensure the 

data, conclusions, and recommendations are correctly understood and appropriately used. 

PSM annunciations are one way, but not the only way, and may not necessarily be the best way, 

to address PSM+ICR. Although this study indicates that malfunction annunciations have the 

potential to reduce PSM+ICR, the feasibility of achieving those benefits through malfunction 

annunciation or other means has not been assessed or established. Such feasibility should be 

assessed and established before any regulatory, implementation, or other action is taken. 

PSM annunciation is the only solution investigated in this study. Investigation and analysis has 

provided sufficient understanding to state that the data and analysis suggest that PSM 

annunciation has the potential to reduce the rate of PSM+ICR. But one can only say that PSM 

annunciation could (i.e., might), not would, reduce the rate of PSM+ICR. The data does not 

support stating that PSM annunciation is the preferred solution. PSM annunciation may, or may 

not, be the most feasible, and therefore, the preferred solution. It is important to consider 

alternative solutions, to understand the advantages and disadvantages of each solution, and to 

quantify the comparative feasibility and effectiveness of PSM annunciations versus other 

alternatives. 

The approach to reducing PSM and PSM+ICR problems should not deflect industry attention 

and resources from other, more important, safety enhancements. The challenge is to identify and 

develop the most affordable and effective approaches to the problem. The Commercial Aviation 

Safety Team (CAST) implementation plan indicated that the best total approach may focus on 

crew training, development of standard operating procedures (SOPs), policy development, or 

safety culture rather than onboard hardware or software changes for the current fleet. New 

airplane designs may benefit from some new onboard hardware and software approaches. 

However, it could take decades after the introduction of those changes to new airplane designs to 

see a significant change to the overall accident rate. 

2-1
2.2 SUMMARY AND CONCLUSIONS. 

In general, a consistent contributing factor in PSM+ICR events is lack of crew awareness of the 

existence or location of a PSM, i.e., the lack of a clear and explicit indication or annunciation 

that a PSM exists, or lack of a clear and explicit indication or annunciation of the affected 

engine(s). In general, the crew should be made aware: 

• that a propulsion system malfunction and/or symptom exists. 

• of the specific engine affected. 

• of the specific type or nature of the propulsion system malfunction or symptom, and the 

manner and extent of its affect on the engine and on subsequent operations. 

ICR prevention potential through malfunction annunciation exists in 50% or more of fatal 

events. Fatal events with prevention potential account for 88% of all PSM+ICR fatalities. 

Prevention potential also exists in Hull Loss, Substantial Damage, and Incidental ICR events. 

Most prevention potential exists in the area of Loss of Control (LOC), followed by Other and 

Shutdown or Throttled Good Engine. The least prevention potential exists in the area of rejected 

takeoff above takeoff decision speed (RTO>V1). PSM annunciations offer little or no 

prevention potential for fatal RTO>V1 events. PSM annunciation above V1 during takeoff risks 

causing RTO>V1 events. Note that where prevention potential has been judged to exist, it 

means only that the event might have been prevented, not that it would with certainty have been 

prevented. 

Most prevention potential is associated with Powerloss and Surge, followed by Failed Fixed 

Thrust malfunctions. The majority of these malfunctions appear to be detectable. The principal 

detection issue is reliable and meaningful detection—particularly in the case of Surge. There is 

less potential for ICR prevention or mitigation in the area of High Vibration, which is 

categorized as a secondary PSM, and the potential for ICR prevention or mitigation has yet to be 

determined or demonstrated for Thrust Asymmetry, which is considered an airplane-level effect, 

not a PSM. 

Surge and Powerloss, the major types of PSM associated with ICR, are among the top three inservice PSMs currently reported. 

The same type PSM+ICR events continue to occur in service: LOC, Other, Shutdown Good 

Engine, and RTO>V1. Ten post-Aerospace Industries Association (AIA) Report PSM+ICR 

events were documented: four Other, two LOC, three Shutdown Good Engine, and one 

RTO>V1. The list contains Fuel System PSM-related ICRs not reported or included in the AIA 

report data. 

A Boeing study and analysis of PSM+ICR events suggested that explicit annunciation of the 

following PSMs could provide a potential safety benefit to the current worldwide fleet: 

• Engine Failure (subidle) 

• Engine Thrust Shortfall 

2-2
• Significant Engine Surge 

• Engine Overthrust 

Malfunction annunciation, or other equivalent means, should be used to enhance timely crew 

awareness, understanding, and response to these PSMs. PSM+ICR event data indicated that, in 

most cases, annunciation delays on the order of 5 to 10 seconds would not significantly reduce 

the potential safety benefit. However, the earlier the detection and annunciation, the greater the 

overall potential benefit. Note the following considerations. 

• Careful implementation of these PSM annunciations (i.e., how/where/when implemented/ 

provided) is crucial to effectiveness. Implementations must accommodate diverse engine 

and airframe designs and operational philosophies. And the factors that have limited 

previous implementation must be considered and addressed. 

• PSM annunciation has little or no RTO>V1 prevention potential or historical safety 

benefit but, instead, risks causing RTO>V1 events. 

• A feasibility assessment for High Vibration and Stuck Throttle is required before 

implementation recommendations can be made. 

• Each PSM annunciation must be evaluated for the relative feasibility of developing and 

implementing on a model-by-model basis and fleet-by-fleet basis for postproduction, inproduction, and future production aircraft. 

2.3 RECOMMENDATIONS. 

The following PSMs should be assessed for feasibility of Flight Deck annunciation: 

• 

• 

• 

Engine Failure (subidle) 

Engine Thrust Shortfall 

Engine Surge 

• Engine Overthrust 

Feasibility should be assessed for production, retrofit, and new and future airplanes. Feasibility 

assessment should include, but not be limited to, CAST analysis. Feasibility should include a 

relative assessment of malfunction annunciation versus other interventions such as crew resource 

management (CRM) and malfunction training, airspeed and attitude awareness enhancements, 

flight control protection, and compensation functions. Crew training, development of SOPs, 

policy development, or safety culture may be more feasible interventions than onboard hardware 

or software changes for the current fleet. Each PSM annunciation should be evaluated for the 

relative feasibility of development and implementation on a model-by-model basis and fleet-byfleet basis for postproduction, in-production, and future production aircraft. 

2-3
The following follow-on research efforts should be sponsored and supported: 

• Follow-on research to define detection requirements, demonstrate/validate reliable Surge 

detection, and refine and validate Surge and Powerloss PSM annunciations. 

• Engine manufacturer, airframe manufacturer, and airline collaboration on PSM 

annunciation and detection feasibility assessments, detection implementation 

requirements, and detection and annunciation validation activities. 

Thrust Asymmetry, Stuck Throttle, and High Vibration annunciation require additional study 

and validation of potential benefit and risk before recommendations can be made in those areas. 

The following follow-on research efforts could be sponsored and supported: 

• A more comprehensive analysis of the Crew Error Classification versus Hull Loss with 

fatalities (HF) events is recommended to provide the insight required to develop the most 

effective error prevention strategies and designs and assess their effectiveness. 

• Development and implementation of a formal process for reporting and documenting inservice ICR is recommended. Existing databases should be evaluated for their ability to 

capture and identify ICR-related events. 

2-4
3. OVERALL PSM DETECTION AND ANNUNCIATION RISK/BENEFIT ASSESSMENT

(TASK 1.3). 

3.1 TERMS AND DEFINITIONS. 

The following key terms and definitions related to PSM annunciations are used throughout this 

report. These are provided to ensure a common definition. 

• Alert—A subset of annunciation. A nonnormal malfunction-specific or nonnormal 

condition-specific annunciation requiring crew awareness or action. Alerts are generally 

differentiated from normal annunciations by the use of aural and visual attention-getting 

components and messages designed to provide appropriate crew awareness and 

understanding, and elicit appropriate crew response by linking to a specific nonnormal 

procedure. Traffic Collision Avoidance System alerts, Ground Proximity Warning 

System alerts, Engine Indication and Crew-Alerting System (EICAS) alerts, dedicated 

alert lamps/indications and alert lamps/indications with aurals are typical examples. 

• Annunciation—A broad category of normal (i.e., nonalert) and nonnormal (i.e., alert) 

indications and/or aurals designed to draw or focus crew attention and to support crew 

awareness or action. In general, a discrete indication and/or aural that provides event or 

condition information by occurring and clearing. An annunciation is displayed or occurs 

when its corresponding event or condition occurs. Annunciations are generally transient 

in nature and may be displayed on the Primary Flight Display (PFD), Navigation Display 

(ND), Engine, and other display formats. 

• Engine Exceedance—Engine speed/thrust or other operating limit exceedance. 

• Engine Failed Fixed Thrust—Engine failure to some intermediate engine speed/thrust 

level between idle and max power that creates the potential for commanded engine thrust 

to be either greater or less than actual engine thrust, i.e., creates the potential for thrust 

shortfall or overthrust. 

• Engine Failure—Engine failure to subidle engine speed/thrust level. Engine combustion 

may or may not have ceased. 

• Engine Flameout—Engine combustion has ceased. A subset of in-flight shutdown 

(IFSD). 

• Engine Pressure Ratio (EPR)—The ratio of turbine discharge pressure to compressor 

inlet pressure. EPR is a measure of thrust provided by the engine. EPR indicators 

provide the ratio of the pressure of the air as it comes out of the turbine to the pressure of

the air as it enters the compressor. EPR is a certified thrust-setting parameter. 

• Inappropriate Crew Response—An event where the crew fails to follow the published 

procedures, operating policies, or training practices (PPP) in a timely manner. The 

following situations would be considered undesired crew response (UCR): (1) The crew 

wittingly or unwittingly executed the wrong PPP; (2) The crew wittingly or unwittingly 

3-1
executed the PPP incorrectly; (3) The crew executed the correct PPP for the wrong 

reason(s); (4) The crew intentionally deviated from PPP; and (5) The crew encountered a 

situation where the PPPs, or the circumstances/information for their application, were 

vague, incorrect, conflicting, or nonexistent. This includes events where the crew was 

provided insufficient information and inadequate procedures, as well as events where the 

crew exhibited unacceptable performance. 

• Indication—Typically provided by mechanical gage/dial or display. The Primary and 

Secondary engine parameters EPR, N1, exhaust gas temperature (EGT), N2, N3, oil 

pressure, oil temperature, vibration, fuel flow, etc.) are engine indications. 

• Indication Annunciation—A subset of annunciation. A nonnormal malfunction-specific 

or nonnormal condition-specific annunciation requiring crew awareness or action 

displayed on or with the primary or secondary engine indications. 

• Indication Feature—Normal indication feature implementation or enhancement. 

Indications and enhancements are provided to reduce crew integration activity and 

thereby reduce crew workload. Indication features generally involve collocation of 

related information (e.g., commanded and actual state information), presentation of 

control target and system limit indications, and other features, elements, and 

implementations that differentiate information and make it easier and quicker for the user 

to obtain desired information. 

• In-Flight Shutdown—Commanded or uncommanded cessation of engine combustion in 

flight. This includes engine failure conditions such as Engine Fail Low conditions 

(e.g., flameout) and engine shutdown by either the flight crew or the engine control 

system. 

• Modern Fleet—Aircraft designed and certified in the 1980s and later. B717, B737NG, 

B747-400, B757/767, B777, MD11, MD90, A319, A320, A321, A330, and A340. 

• Nonrecoverable—Propulsion System Malfunction. A PSM from which the engine or 

engine controller will not automatically, or with crew action, recover to a normal level of 

functionality/performance. Typical Nonrecoverable events involve sense line or 

controller failures, foreign object damage, a failure of blades, seals, bearings, controllers, 

etc., and/or significant engine damage. 

• Powerloss—Actual engine thrust is less than commanded engine thrust. Engine Thrust 

Shortfall, Partial Powerloss/Rollback, Engine Subidle, or Engine Flameout are powerloss 

examples. 

• Recoverable—Propulsion System Malfunction. A PSM from which the engine 

automatically, or with crew action, recovers to commanded thrust and full range of 

normal functionality and performance. Most Recoverable events involve no engine 

component failures and no significant engine damage. 

3-2
• Surge—Turbine engine surge is a sudden aerodynamic reversal of airflow in the engine 

compressor. The airflow reversal, which may be accompanied by audible sounds and 

vibration, occurs with the downstream high-pressure air in the compressor escaping 

forward out of the engine inlet. On modern high by-pass turbojet engines, the flow 

reversal is very rapid and usually produces a loud bang similar to an explosion. The 

intensity of the sound depends on the engine power setting or pressure ratio as well as the 

amount of expansion permitted by the inlet. Depending on the type of compression 

instability, there may be single, multiple, or continuous surges and associated engine 

parameter fluctuations, e.g., rapid decrease in rotor speeds, pressures, and fuel flow, and 

typically an EGT increase. There are three surge types: (1) Self-Recoverable, 

(2) Recoverable with Crew Action, and (3) Nonrecoverable. Meaningful Surge is 

defined as surge that requires crew action. 

• V1 – Takeoff Decision Speed 

• Vr – Takeoff Rotation Speed 

• Undesired Crew Response—An event where the crew fails to follow the published PPPs 

in a timely manner. The following situations would be considered a UCR: 

− The crew wittingly or unwittingly executed the wrong PPP. 

− The crew wittingly or unwittingly executed the PPP incorrectly. 

− The crew executed the correct PPP for the wrong reason(s). 

− The crew intentionally deviated from PPP. 

− The crew encountered a situation where the PPPs, or the circumstances/ 

information for their application, were vague, incorrect, conflicting, or 

nonexistent. 

This includes events where the crew was provided insufficient information and 

inadequate procedures, as well as events where the crew exhibited unacceptable 

performance. 

The overall assessment (task 1.3) was a joint flight deck and propulsion engineering task to 

summarize the detection feasibility and risks, and the operational benefits and risks, associated 

with detecting and annunciating certain PSMs associated with ICR. 

To ensure understanding of the discussion, conclusions, and recommendations, it is particularly 

important that the reader distinguish between normal engine parameter indications with 

enhanced features, nonnormal engine parameter indication annunciations, and nonnormal alert 

annunciations. 

3-3
3.2 BENEFIT/RISK ASSESSMENT OF PSM ANNUNCIATIONS. 

The specific PSMs assessed and addressed in this report are: 

• Powerloss—Engine Failure (Subidle/Flameout/etc.), and Thrust Shortfall (actual thrust 

less than commanded thrust) 

• Surge—Recoverable with Crew Action and Nonrecoverable 

• Failed Fixed Thrust—Stuck Throttle, Thrust Shortfall (actual thrust less than commanded 

thrust), and Overthrust (actual thrust greater than commanded thrust) 

• High Vibration 

• Thrust Asymmetry 

The following sections discuss the general and specific operational benefits and risks of 

annunciation, and detection feasibility considerations, associated with the engine malfunctions 

listed above. 

3.3 GENERAL OPERATIONAL BENEFIT AND RISKS OF PSM ANNUNCIATION. 

The vast majority of PSM events do not result in ICR. And the majority of PSM+ICR events do 

not involve fatalities or catastrophic consequences. In general, adding annunciation adds 

complexity. A proper balance is needed; adding complexity (and the potential cost and risk of 

not operating properly) must be feasible and may only be worthwhile for the most severe 

consequence conditions. 

3.4 POTENTIAL OPERATIONAL BENEFIT OF PSM ANNUNCIATION. 

Potential operational benefits are based on the assumption of reliable detection and annunciation. 

Reliable implies consistent and meaningful detection and annunciation. The general benefit of 

annunciation is that it increases the likelihood of timely and appropriate crew awareness, 

understanding, and response. Consequently, crews are less likely to be misdirected into falsely 

believing some other condition or malfunction occurred and taking inappropriate or unnecessary 

action. 

In general, the potential operational benefit of PSM annunciation is in mitigation of ICR events 

through correct crew response based on (1) timely crew awareness that a PSM exists; 

(2) understanding of the specific PSM that exists, and therefore, the appropriate procedure that 

should be used; and (3) identification of the specific engine(s) affected by the PSM. With 

respect to reducing ICR events, any annunciation must accomplish these objectives. 

3-4
3.5 OPERATIONAL RISKS OF PSM ANNUNCIATION. 

Distraction during High Crew Workload Flight Phase is the first operational risk identified with 

PSM annunciation. The risk associated with annunciation (indication or alert), in general, 

regardless of whether the annunciation is true or false, relates to UCR to the annunciation itself, 

not the malfunction being annunciated. This is primarily a concern in flight phases where the 

crew does not have time to assess the indication or alert, e.g., during takeoff above V1, or on 

short final approach and flare. Anything designed to attract crew attention, risks crew distraction 

and UCR. Typically, in takeoff and approach phases, annunciations are temporarily inhibited, 

where the risk of delaying annunciation is far outweighed by the risk of ICR such as RTO>V1 or 

low-altitude go-around. 

False Annunciation is the second operational risk identified with PSM annunciation. The 

immediate risk of false annunciation is (1) unnecessary distraction and (2) erroneous crew 

awareness, understanding, and response. The crew may be distracted from accomplishing 

important tasks, may become confused by noncorroborating or conflicting indications, or may 

take action that unnecessarily affects airplane operation or capability. The longer-term risk of 

repeated false annunciation is potential loss of alert and alerting system credibility and possible 

crew failure to respond when required. If a false alert occurs repeatedly, the crew can quickly 

become desensitized to the alert and ignore or otherwise fail to respond to the alert when valid. 

The crew may also begin to question other valid alerts. In all cases, crew workload and error 

potential are unnecessarily and undesirably increased. The acceptability of false annunciation is 

proportional to the criticality of the condition and crew response. 

Failure to Annunciate/Detect is the third operational risk identified with PSM annunciation. The 

risk associated with failure to annunciate when the crew knows an annunciation exists, (i.e., is 

part of the airplane design) and may be relying on its presence or absence, is primarily that crew 

response may not occur, or may occur too late. In the absence of an alert, detection/awareness 

and interpretation/understanding is more difficult and error prone. This is likely more so than if 

there was no annunciation as part of the airplane design, and the crew was responsible to monitor 

for condition. In the absence of an alert, and particularly when little time is available for 

evaluation, there is the general increased risk that crew response may be erroneous or 

inappropriate. 

3.6 GENERAL DETECTION FEASIBILITY CONSIDERATIONS. 

This section describes the general detection feasibility considerations. Issues centered around 

malfunction detection, identification, timing, and recoverability are discussed. 

3.6.1 Identification of Malfunctioning Engine. 

One aspect of a PSM that results in an ICR is the ability of the crew to determine which engine 

may be malfunctioning. From a crew detection perspective, this problem manifests itself in two 

ways. First, the crew is unaware that any malfunction or the type of (engine) malfunction that 

has occurred. Second, once the crew is aware that a PSM has occurred (usually through cues 

3-5
such as noise, vibration, or change in attitude), the crew is unable to determine from existing 

indications or annunciations which engine is affected. 

The feasibility of detection or identification of which engine is affected is intuitive, given that a 

malfunction has been identified. The risk lies in the inability to detect all engine malfunctions 

(miss detects). This risk increases if attempting to detect recoverability versus nonrecoverability 

as defined herein. Except for the subidle condition, the risk of missed detection increases further 

when the power setting of the malfunctioning engine is low. 

3.6.2 Detection Time Lag Rule. 

Tasks 2.1 and 1.2 analyses suggest that providing an annunciation for events during the takeoff 

phase of flight is not beneficial or effective from V1 to 400 feet above ground level (AGL). 

Such annunciations unacceptably increase the risk of causing more RTO>V1 events than they 

prevent. It was assessed that training for surge recognition is a more effective means to mitigate 

the risk of RTO>V1. Accepting this conclusion, the rule for detection concepts is that 

immediate determination of a detected PSM is not required to achieve a safety benefit in LOC, 

Shutdown Good Engine, and Other ICR events. Restated, some given amount of time can be 

allowed after the actual occurrence of the PSM before detection and annunciation is required. 

This is referred to as the Time Lag Rule. Continuing with the theme of the PSM+ICR that have 

the highest safety concern, the Time Lag Rule applies to all PSM categories being studied 

herein. PSM+ICR event data indicate that, in most cases, annunciation delays on the order of 5 

to 10 seconds would not significantly reduce the potential safety benefit. However, the earlier 

the detection and annunciation, the greater the overall potential benefit. 

3.6.3 Recoverability/Nonrecoverability. 

The task 5.2 report (see appendix E) documents work performed by a subcontractor relating 

specifically to Surge events and whether they are recoverable or nonrecoverable. The 

recoverability/nonrecoverability detection scheme developed in this work fuses the results of the 

surge detection algorithm (described below) with an additional algorithm to determine whether 

the engine would recover from the surge or not. It is important to provide a definition of 

recoverability in context of this work. A surge that will recover (Recoverable Surge) is defined 

as a PSM after which the engine will respond to engine control (automatic or crew input) to 

provide any normal requested power setting and thrust. Conversely, a Nonrecoverable Surge is 

defined as a PSM after which the engine, although it may run surge-free at some power 

setting(s), is not able to produce requested thrust at all possible normal power settings. 

3.6.4 Detection Feasibility. 

The task 5.2 report stated that the recoverability detection scheme “... operates in much the same

fashion as the surge detection except that it waits for ... [engine parameters] ... to respond 

normally to TRA and Bleed, meaning that the engine is back in control.” This scheme was 

successful in determining whether an engine would recover from a surge event or not. The time 

required was on the order of 3 to 5 seconds. Recall that the Time Lag Rule applies. The 

subcontractor reports that the addition of a vibration monitor to the aforementioned could 

3-6
improve the robustness (no missed detects, no false positives) of the surge detection/ 

recoverability scheme. 

The subcontractor stresses the fact that claims of success are based on a single data point in the 

case of nonrecoverable surge. In addition, the engines with events categorized as Recoverable 

were not directly challenged to high power during the same flight, but rather, ground tests were 

performed to establish surge margin. With these qualifiers, the research performed by the 

subcontractor nevertheless appears promising. Follow-on demonstration and validation of 

detection reliability using a larger data set is required before any final determination of surge 

detection reliability and feasibility can be made. 

A determination on the recoverability/nonrecoverability of other categories of PSM could be 

made in the same manner. The risk remains in (1) the ability to accurately model the engine that, 

in part, leads to (2) the ability to detect all categories of PSM. Again, this risk increases at low 

power settings. One possible method to reduce the risk at low power settings is to adopt a crew 

procedure that challenges the engine to higher power settings. This is, in essence, the second 

part of the current Surge procedure where the crew is instructed to advance the engine power 

setting to see if the engine will run surge-free. With existing instrumentation, this same

procedure could provide data to reliably assess whether the PSM is recoverable or 

nonrecoverable. 

3.6.5 False Detection Risk Discussion. 

Depending on the operational effects in terms of hazard classification (i.e., major, hazardous, or 

catastrophic), the system design reliability should be commensurate with the hazard 

classification. If a false annunciation creates a hazardous situation, then a false warning 

reliability would need to be on the order of 1e-7 or better per flight hour. 

3.6.6 Failure to Detect Risk Discussion. 

Depending on the operational effects in terms of hazard classification (i.e., major, hazardous, or 

catastrophic), the system design reliability should be commensurate. If failure to detect creates a 

hazardous situation, then a failure to warn reliability would need to be at least an order of 

magnitude less than the condition being detected to provide annunciation design margin. 

3.6.7 Recoverability Research Recommendations. 

A tristate detection concept should be explored in relation to the recoverability/nonrecoverability 

of a PSM. The three states to consider are (1) normal operation (recoverable), (2) 

Malfunctioning (nonrecoverable), and (3) Indeterminate. Research to identify the combination 

of parameters and their appropriate values to make a high confidence determination of state 1 

and state 2 is needed. The validity of using the suggested engine challenge procedure needs to 

be studied for instances when the parametric data is in the Indeterminate state. This engine 

challenge procedure should result in a high confidence determination of the engine being in state 

1 or state 2. 

3-7
3.7 POWERLOSS ANNUNCIATION POTENTIAL OPERATIONAL BENEFITS/RISKS. 

This section discusses potential detection and annunciation benefits and risks associated with 

powerloss. Powerloss is defined as engine failure (subidle/flameout/etc.), thrust shortfall, or 

partial powerloss or rollback. 

3.7.1 Powerloss Annunciation Potential Benefits. 

As previously stated, crew awareness of PSM and identification of affected engine(s) must be 

provided to mitigate ICR risk. The task 1.2 report identified an operational safety benefit from a 

powerloss annunciation that provides timely crew awareness and identifies the affected 

engine(s). Per the task 1.2 report analysis, the failure to timely detect and consequent lack of 

timely awareness of powerloss is associated with all type ICR events in general, and fatal and 

hull loss LOC events in particular. 

Annunciation of a Powerloss PSM would provide crew awareness that actual thrust is lower than 

commanded thrust on one or more engines. It is expected that such awareness would prompt the 

crew to assess the powerloss impact on flight operations and subsequently respond in an 

appropriate manner that ensures continued safe flight and operation. The annunciation should 

prompt a crew response to control any associated thrust asymmetry; act to safely configure, 

restore, or secure the affected engine(s); and re-evaluate the flight plan. 

The task 1.2 report analysis indicated that the potential safety benefit of powerloss annunciation 

accrues to LOC and RTO>V1 events. The RTO>V1 risk from annunciation during takeoff roll, 

as discussed in section 3.6.2. A powerloss annunciation in this flight phase is not recommended 

because true or false detection and annunciation of powerloss during takeoff roll below V1 could 

undesirably distract the crew or prompt an unnecessary and inappropriate RTO>V1 and 

inappropriate crew concern for asymmetric reverse thrust. However, combining the detection of 

this PSM with other appropriate airplane system functions to aid the crew in maintaining 

airplane control, e.g., B777 Thrust Asymmetry Compensation (TAC), may be of benefit. 

3.7.2 False Powerloss Detection Risks. 

The AIA report LOC events generally occurred in high workload phases of flight, e.g., 

approach/go-around or takeoff climb. False or nuisance alerting of powerloss during approach 

might prompt the crew to change aircraft configuration or might delay or otherwise affect a goaround decision. False or nuisance alerting of powerloss during takeoff climb might prompt the 

crew to change aircraft configuration or prompt an unnecessary air turn back. In both these 

cases, workload would unnecessarily increase and crew distraction could delay, prevent, or 

otherwise affect proper aircraft configuration or accomplishment of other flight phase-related 

tasks. 

3-8
3.7.3 Failure to Annunciate/Detect Powerloss Risks. 

Failure to detect and annunciate a powerloss on approach risks the crew being unaware that goaround capability and performance are affected. Failure to detect and annunciate a powerloss on 

takeoff may risk the crew being unaware that takeoff and climb capability and performance are 

affected. Both cases, combined with crew failure to maintain appropriate airspeed and attitude, 

can lead to LOC. 

3.7.4 Confidence of Correct Powerloss PSM Detection. 

Detection of a subidle condition is considered highly feasible. A separate determination of 

airplane-level annunciation feasibility is required. Current production models apply a detection 

scheme that primarily compares the engine high-pressure spool speed to some prescribed level. 

The prescribed level is determined from the engine idle thrust model, which is dependent on 

flight condition. The risk associated with this scheme lies in setting the level, below which 

subidle is declared, such that false detects are minimized (e.g., undershoot from pull back) and is 

considered very small. 

At or above idle, detection of thrust shortfall is also considered feasible. One method to detect 

thrust shortfall is by determining both commanded and actual thrust from an engine model. 

Commanded thrust is determined from the power-setting input, whereas actual thrust is 

calculated using the power-setting and engine parametric data. 

Identification of an actual thrust, some prescribed amount lower than the commanded thrust, 

would be identified as a thrust shortfall. For example, existing applications use prescribed 

difference in commanded to actual thrust of approximately 10% to activate Engine Failure and 

Thrust Loss logic. 

The risk of false or missed detects using this method lies in the current method to measure thrust. 

In reality, thrust is not measured on-wing. What is measured is a parameter that is used to 

indicate that an assumed thrust has been obtained, i.e., a sensed parameter that relates to thrust 

and increases and decreases as thrust increases and decreases. This method was certified 

through the development of a model of the test stand’s and/or instrumented airplane’s measured 

thrust and the indication parameter. This model was developed to ensure that a minimum thrust 

is attained. The thrust may be higher due to, in varying degrees, engine configuration, engine to 

engine variation, engine age, etc. Additionally, the model was not developed to provide a thrust 

indication during a transient. Most importantly, the model does not include an indication/thrust 

relationship for a damaged engine (i.e., if the engine is damaged, the thrust to indication 

parameter relationship is unknown). The risks in using this method increase as the commanded 

thrust decreases (i.e., the determination of actual thrust, from parametric data, to compare to a 

commanded thrust is more difficult at low power settings). This is because the inaccuracies of 

the thrust to indication parameter model described above become more pronounced at low 

power. The increased risk of missed detection during a transient or at low power settings may 

lead to an inhibit of the detection algorithm in these operational states. This inhibit leaves open 

the operational risk of missed detection at low power, leading to the crew being unaware that 

3-9
higher power will not be obtained from the failed engine if commanded. Only when the higher 

power is commanded would the detection method provide a valid result and the crew be alerted. 

3.7.5 Powerloss Detection Further Research. 

The engine challenge procedure described above is one possible method to reduce the risk of 

missed detection of a Powerloss PSM for an engine at low power. Research into what would 

trigger the use of this procedure is needed. The determination, based on existing algorithms

using parametric data, of the engine being in the Indeterminate state, as described in section 

3.6.7, may be that trigger. Specifically, a Powerloss PSM with the following characteristics 

should be investigated. 

• The malfunctioning engine does not immediately experience a powerloss to idle or 

subidle condition. 

• The flight crew takes action (for some reason) to reduce the power setting on the 

malfunctioning engine. 

• The engine indications suggest the malfunctioning engine is responding to the crew 

action. 

• The engine indications suggest the malfunctioning engine is running to schedule (at low 

power). 

Further research is recommended to reliably detect a low power Powerloss PSM, i.e., powerloss 

at or near idle power. Currently, engine controls are designed to ensure operational stability at 

low or idle power. The current methods for determining thrust are less accurate at low power 

than at higher power. This leads to more ambiguity when using an actual to commanded thrust 

comparison algorithm. Different methods of using existing data or different data capture 

capabilities may lead to a more reliable determination of actual to commanded thrust validity. 

3.8 SURGE ANNUNCIATION POTENTIAL OPERATIONAL BENEFITS AND RISKS. 

The term compressor surge is used to describe the audible sound heard due to a sudden 

aerodynamic reversal of flow in the engine’s compressor operation. A reversal of flow occurs 

with the downstream high-pressure air in the compressor escaping forward through the inlet. 

This reversal of flow is rapid and produces a very loud audible bang, similar to an explosion, for 

modern high by-pass ratio engines. The intensity of the noise depends on the engine power 

setting or pressure ratio as well as the amount of expansion permitted by the inlet. Depending on 

the type of compression system instability, there may be single, multiple, or continuous multiple 

loud bangs, and associated engine parameter fluctuations. The effects of a compressor surge 

result in a rapid decrease in rotor speeds, pressures, and fuel flow, and typically an increase in 

EGT. 

There are three type of surge: (1) Self-Recoverable (typically recovers within 5 seconds without 

any crew intervention), (2) Recoverable with Crew Action (the crew reduces power and surging 

3-10
stops and the engine returns to normal functionality at all normal power settings/operating 

conditions), and (3) Nonrecoverable, including (a) where the engine surge cannot be stopped and 

(b) where the engine does not recover to normal operation at all power settings or operating 

conditions (i.e., the surge may stop at low power but resume when power is advanced). With the 

exception of RTO>V1 events, the surge types associated with ICR are primarily types 2 and 3. 

3.8.1 Surge Annunciation Potential Benefits. 

As previously stated, crew awareness of PSM and identification of affected engine(s) must be 

provided to mitigate ICR risk. The task 1.2 report identified an operational safety benefit from a 

surge annunciation that provides timely crew awareness and identifies the affected engine(s). 

Per the task 1.2 report analysis, the failure to timely detect and consequent lack of timely 

awareness of surge is associated with Other, Shutdown/Throttled Good Engine (SDTGE), and 

RTO>V1 events in general, and with fatal and hull loss Other and SDTGE events in particular. 

Annunciation of a Surge PSM would provide crew awareness that surge is occurring on one or 

more engines. For surge, that automatically recovers, it is expected that awareness will ensure 

the crew is not misdirected into falsely believing some other condition or malfunction occurred 

and taking inappropriate or unnecessary action. For surge that does not automatically recover, 

the annunciation would direct the crew to the appropriate checklist procedure, prompt the crew 

to reduce power on the affected engine(s), and subsequently respond in an appropriate manner 

that ensures continued safe flight and operation. This response should involve controlling any 

thrust asymmetry that might result, acting to safely configure, restore, or secure the affected 

engine(s), and re-evaluating the flight plan. Engine-specific annunciation of surge should 

prevent Shutdown Good Engine events (SDGE) and the procedural errors frequently associated 

with PSM+ICR events in the Other category. 

The task 1.2 report analysis indicated that the potential safety benefit of surge annunciation 

accrues to Other and SDTGE events. The RTO>V1 risk from annunciation during takeoff roll 

was discussed in section 3.6.2. A surge annunciation in this flight phase is not recommended 

because true or false detection and annunciation of surge during takeoff roll below V1 could 

undesirably distract the crew or prompt an unnecessary and inappropriate RTO>V1 or prompt 

the crew to inappropriately reduce power below safe altitude. 

3.8.2 Surge Detection/Annunciation Risks. 

False detection and annunciation of surge during takeoff roll below V1 could prompt an 

unnecessary RTO>V1. False detection and annunciation of surge during takeoff climb, cruise, 

or descent could prompt an unnecessary thrust reduction or engine shutdown. False or nuisance 

alerting of surge during approach might prompt the crew to change aircraft configuration or 

might delay or otherwise affect a go-around decision. In all in-flight cases, workload would 

unnecessarily increase and crew distraction could delay, prevent, or otherwise affect proper 

aircraft configuration or accomplishment of other flight phase-related tasks. 

Failure to detect and annunciate a surge on approach risks the crew being unaware that goaround capability and performance may be affected. This can lead to an unexpected airspeed 

3-11
loss and consequent LOC. Failure to detect and annunciate a surge on takeoff may risk the crew 

being unaware that takeoff and climb capability and performance are affected. Additionally, in 

the absence of an explicit annunciation, the crew may take inappropriate action such as SDGE, 

or the loud bangs and vibration that typically accompany engine surge may misdirect the crew to 

believe that some other condition exists. 

3.8.3 Confidence of Correct Surge PSM Detection. 

The detection of a compressor surge is considered highly feasible. However, there does exist 

some degree of risk for determining meaningful versus not meaningful surge. A separate 

determination of airplane-level annunciation feasibility is required. Technical experts from

Boeing agree that, from a first principles standpoint, the engine burner pressure is the primary 

indicative parameter for surge. In some current applications, a Surge event is detected and 

flagged as part of the central maintenance computer data. The engine exhaust gas temperature is 

an additional indicator for surge. Using these parameters on existing airplanes is problematic in 

the response of the sensors used to measure them. In the case of the burner pressure, the sensors 

must produce accurate pressure, with a rapid response, in a range from 15 to 450 psi. Existing 

production-quality sensors do not support such ranges at the needed rates. The transient nature 

of a Surge event is damped by the slow responsiveness of the thermocouples or other 

temperature-measuring devices used to capture engine exhaust temperature. Advances in 

sensing of these parameters (i.e., high response, high reliability, low cost) are an opportunity for 

future research. 

A caveat in the detection of surge is whether or not it is meaningful. It has been defined that a 

meaningful surge is one in which crew action is required. The corollary to this is an engine that 

has or is experiencing a surge that the control system cannot accommodate or recover to its presurge state. In this case, the detection scheme would be to identify a surge after the control logic 

has attempted to maintain engine control. This is supported by the results from the task 5.2 

report (see appendix E) on work performed by a subcontractor for this study and broaches the 

subject of recoverability/nonrecoverability, as detailed below. The ability to reliably and 

immediately detect (no false indications) meaningful (crew action required) surges is high risk. 

However, the ability to provide a meaningful surge indication for a continuously surging engine, 

say three or more surge cycles (e.g., after 5 seconds of persistent surge), is feasible. 

As stated above, a surge detection scheme was developed by a subcontractor as part of this 

contract effort. The scheme employs a derivative limit for various parameters combined with a 

cross correlation of those parameters. The derivative functions are based on engine component 

performance maps derived empirically from the data. This algorithm successfully detected the 

surges identified in the data provided. In addition, the data contains what are agreed to be false 

detects of a Surge event. The subcontractor’s algorithm was successful in avoiding false detects 

on this data. However, the algorithm was not validated with extensive data. The accuracy of the 

subcontractor’s surge detection scheme should be improved with the use of engine original 

equipment manufacturer component performance data. Additionally, the subcontractor’s task 

5.2 report (appendix E) concludes that a means to more reliably detect a surge is possible with 

data available from a full authority digital engine control (FADEC)-controlled engine with at 

least one qualifier. Most health management data capture is performed at 1 Hz. This data 

3-12
capture rate leaves detection methods vulnerable to the engine control logic attempting to 

accommodate to the PSM. The task 5.2 subcontractor recommended a data capture rate of 50 ms

or less. This is more than accommodated by the data rates available to the engine control. 

However, the response of the sensors remains an issue. In summary, reduction of the risks 

associated with false or failure to detect a Surge PSM is dependent on the implementation of 

enhancements of existing methods and may also include the need for engine sensor 

enhancements. 

3.8.4 Surge Detection Further Research. 

Highly reliable, low cost means to sense burner pressure with a rapid response in a range from

15 to 450 psi is considered technology that would improve the detection of meaningful Surge 

events. The same is true for sensing the engine exhaust gas temperature in regards to its damped 

responsiveness existing thermocouples or other temperature-measuring devices. 

3.9 FAILED FIXED THRUST ANNUNCIATION POTENTIAL OPERATIONAL BENEFITS

AND RISK. 

A Failed Fixed Thrust is defined as Stuck Throttle, Thrust Shortfall (actual thrust less than 

commanded thrust), and Overthrust (actual thrust greater than commanded thrust). The 

occurrence of a stuck throttle on modern aircraft has been greatly reduced. A Failed Fixed (i.e., 

stuck) Thrust due to nonthrottle causes (e.g., fuel management unit failures) is of greater concern 

on modern aircraft, mainly because of the lack of split-throttle cues that aids in detection and 

understanding. 

3.9.1 Failed Fixed Thrust Annunciation Potential Benefits. 

Again, the general theme of crew awareness and identification of affected engine(s) must be 

accommodated to mitigate ICR risk. An operational benefit from an annunciation that 

accomplishes these tasks for a Failed Fixed PSM is supported by analysis of the task 1.2 report. 

Failed Fixed Thrust events include physically stuck thrust levers and the engine failing to a fixed 

thrust level (i.e., a failure in the engine controller). 

As with other PSMs, crew awareness of the PSM and identification of the affected engine(s) 

must be provided to mitigate ICR risk. Task 1.2 identified an operational safety benefit from a 

Failed Fixed Thrust annunciation that provides timely crew awareness and identifies the affected 

engine(s). Per the task 1.2 report analysis, the failure to timely detect and consequent lack of 

timely awareness of a Failed Fixed Thrust annunciation is associated with HF LOC and SDGE 

events in general, and HF LOC events in particular. The AIA report Stuck Throttle events in 

general, and the HF events in particular, appear to involve sufficient time and opportunity for 

prevention potential from earlier crew intervention had the stuck throttle been annunciated or 

otherwise called to the crew’s attention near the time it became stuck. 

Annunciation of a Failed Fixed Thrust PSM would provide crew awareness of an engine thrust 

malfunction on one or more engines and of an actual or potential thrust asymmetry. It is 

expected that awareness would ensure the crew maintains airplane airspeed and attitude control 

3-13
and focuses attention on the correct (i.e., malfunctioning) engine. The annunciation would direct 

the crew to the appropriate checklist procedure, prompt the crew to control power on the affected 

engine(s), and subsequently respond in an appropriate manner that ensures continued safe flight 

and operation. This response should involve controlling any thrust asymmetry that might result, 

acting to safely configure, restore, or secure the affected engine(s), and re-evaluating the flight 

plan. Engine-specific annunciation of surge could prevent LOC and SDGE events. 

The task 1.2 report analysis indicated that the potential safety benefit of Failed Fixed Thrust 

annunciation accrues to LOC and SDGE events. The RTO>V1 risk from annunciation during 

takeoff roll was discussed in section 3.6.2. Any annunciation in the takeoff flight phase is not 

recommended because true or false detection and annunciation of surge during takeoff roll below 

V1 could undesirably distract the crew, prompt an unnecessary and inappropriate RTO>V1, or 

prompt other inappropriate crew action below safe altitude. 

3.9.2 Failed Fixed Detection/Annunciation Risks. 

False detection and annunciation of engine Failed Fixed Thrust during takeoff roll below V1 

could prompt an unnecessary RTO>V1. False detection and annunciation during takeoff climb 

is unlikely until first thrust reduction. At thrust reduction in cruise and in descent, a false alert 

could lead the crew to accomplish an unnecessary procedure and might prompt the crew to 

shutdown a good engine. False or nuisance alerting during approach might prompt the crew to 

unnecessarily go-around or shutdown a good engine. In all in-flight cases, workload would 

unnecessarily increase and crew distraction could delay, prevent, or otherwise affect proper 

aircraft configuration or accomplishment of other flight phase-related tasks. Note that a 

difference in commanded versus actual is equivalent to false or misleading display. This is 

highly unlikely, and the probability of its occurrence has been determined to be acceptable. It is 

more likely that false annunciation would be a normal transient due to a temporary difference in 

commanded and actual versus a persistent or false difference. Such normal nuisance transients 

would be distracting and disruptive of normal flight operations, and it is likely they would occur 

in unusual, unanticipated circumstances, where such a distraction is undesirable. 

Failure to detect and annunciate engine Failed Fixed Thrust risks the crew being unaware that a 

difference in commanded and actual thrust exists. This is typically a difficult condition for 

crews to accurately diagnose, particularly in time-critical situations, and could result in the 

shutdown of the good/unaffected engine or combined with crew failure to maintain airspeed and 

attitude control could lead to LOC. 

3.9.3 Confidence of Correct Failed Fixed Thrust PSM Detection. 

Detection of an engine failed to a fixed thrust condition is considered feasible with relatively low 

risk. A separate determination of airplane-level annunciation feasibility is required. Detection 

of a failed fixed thrust condition would use actual versus commanded thrust monitoring. This 

monitoring scheme would differentiate thrust shortfall and overthrust conditions and the 

magnitude of each condition. 

3-14
Detection of a stuck throttle is meaningful, and therefore required, only in the case of

autothrottle engagement. The detection of this PSM would involve determination of the 

autothrottle mechanism being able to move the thrust lever or be based on throttle or thrust split. 

This type of PSM on current turbofan engines with electronic controls is much less likely to 

occur. 

3.9.4 Failed Fixed Thrust Further Research. 

The following two areas of further investigation are suggested: 

• Investigate what actual thrust versus commanded thrust thresholds would be required to 

provide prevention/mitigation for Failed Fixed Thrust PSM-related PSM+ICR events. 

This follow-on activity could investigate whether existing implementations, e.g., B777 

thrust shortfall alerting, would provide adequate thresholds and timeliness for Failed 

Fixed Thrust PSM detection. 

• Investigate what overthrust alerting means and what thresholds should be used. 

Overthrust alerting has not been implemented on any existing model. 

3.10 HIGH VIBRATION ANNUNCIATION POTENTIAL OPERATIONAL BENEFITS AND

RISKS. 

The correlation between vibration and PSM+ICR is indeterminate. Vibration may or may not 

accompany powerloss, surge, and other engine malfunctions. Vibration may exist but not be 

associated with an engine malfunction or any serious safety concern. Vibration 

detection/sensing is susceptible to error. Engine vibration operating limits are not specified for 

most engines. Therefore, while vibration may be a corroborating indication, in general, it cannot 

be relied upon to be present or meaningful. 

3.10.1 High Vibration Annunciation Potential Operational Benefits. 

The task 1.2 analysis does not identify high vibration as a primary PSM associated with HF or 

hull loss without fatalities (H) events. Where high vibration is identified as the primary PSM in 

the AIA report data, the events are incidental. Consequently, the operational and safety benefit 

of High Vibration annunciation is questionable and likely not very great in terms of PSM+ICR 

prevention/mitigation. Powerloss and Surge events may, or may not, involve High Vibration. 

Where high engine vibration exists, an explicit High Vibration annunciation could direct or 

redirect crew attention to the affected engine, but only if the vibration was high enough to trigger 

the vibration annunciation. The benefit of a High Vibration annunciation may be primarily in 

using it to alert the crew to possible engine malfunction, or in using it in conjunction with other 

indications. 

3.10.2 High Vibration Detection/Annunciation Risks. 

False detection and annunciation of high vibration during takeoff roll below V1 could prompt an 

unnecessary RTO>V1. False detection and annunciation of high vibration during takeoff climb, 

cruise, or descent could prompt an unnecessary thrust reduction, engine shutdown, diversion, or 

3-15
air turn back. False or nuisance alerting of High Vibration during approach might prompt the 

crew to change aircraft configuration or might delay or otherwise affect a go-around decision. In 

all in-flight cases, the workload would unnecessarily increase and crew distraction could delay, 

prevent, or otherwise affect proper aircraft configuration or accomplishment of other flight 

phase-related tasks. 

Failure to detect and annunciate high vibration appears to entail little more risk than the current 

lack of existing annunciation. As previously noted, High Vibration events alone are typically all 

incidental events. In the absence of an explicit annunciation, the crew may not identify the high 

vibration as a PSM and may be misdirected to take other inappropriate action based on whatever 

condition they believe to be causing the vibration. 

3.10.3 Confidence of Correct High Vibration PSM Detection. 

Engine vibration is currently monitored and indicated on all Boeing production models. Most 

airplanes and aerospace engines are designed and operate such that any expected level of engine 

vibration does not present a safety concern. Restated, in general, there is no prescribed engine 

vibration level that requires annunciation for safety. The task 2.1 and 1.2 report analyses suggest 

that annunciating engine vibration has potential for reducing ICR resulting from PSM. Vibration 

is useful, but not as the sole parameter or means in determining if a malfunction exists. 

Vibration monitoring has two potential uses: 

• Establishing and annunciating a vibration threshold could be established well above 

normal vibration magnitude and duration ranges and used to annunciate high vibration 

levels indicative of a possible engine malfunction. This would provide the crew 

awareness that is often lacking in PSM+ICR events. This proposal is supported by 

current design and operational practices. 

• Vibration could be used as an additional parameter in a malfunction detection algorithm

designed to determine whether or not a malfunction exists. In this case, it is 

recommended that engine vibration monitoring be used, in combination with other 

monitoring, to produce an appropriate annunciation for ICR mitigation through correct 

crew awareness and action. Identifying vibration levels to support other annunciations is 

considered highly feasible and is supported by current design practice. 

The primary risk in detection for annunciation is determining the threshold level. 

3.10.4 High Vibration Further Research. 

Further research would be required to determine vibration threshold levels for each engine class 

(e.g., CF6, CFM56-X, PW405X, Trent8XX, etc.) and may require tuning for a specific engine 

within a class. Additionally, vibration levels can show themselves at different levels and at 

different power settings. For example, a recent engine experienced a shift in the compressor 

rotor stack between stages 3 and 4 in the high-pressure compressor, which resulted in high 

vibrations at low power and little to normal vibrations at high power. 

3-16
3.11 THRUST ASYMMETRY. 

Thrust asymmetry is considered an airplane-level effect, not a PSM. Thrust asymmetry may, or 

may not, be due to a PSM. 

When due to a PSM, Thrust Asymmetry is consequential and circumstantial in that it is a 

potential, but not certain, result of a PSM affecting thrust. Depending on the circumstances, 

thrust asymmetry can follow the PSM quickly, slowly, or not at all. The malfunctions 

responsible for thrust asymmetry can, and often do, occur well in advance of a thrust asymmetry. 

The thrust asymmetries of concern are unintentional, can be characterized as a throttle or thrust 

split, or as a difference between desired or commanded thrust (resulting in either overthrust or 

thrust shortfall on the affected engine), and are a symptom/consequence of a PSM. The PSMs 

with potential to cause thrust asymmetry are Engine Fail Low/Powerloss, Engine Fail 

High/Runaway, Engine Failed Fixed Thrust (where commanded and actual thrust differ), Stuck 

Throttle, and Surge with Powerloss. Thrust asymmetry can result from rapid Powerloss events, 

slow Powerloss events, engine failure to respond to commanded thrust, and stuck throttle. 

Thrust asymmetry is a contributing factor in many LOC events. However, as previously noted, 

loss of airplane control is due primarily to failure to control airspeed or attitude. Most LOC 

events are low-altitude, high-power events involving takeoff, climb, or go-around climb power. 

Most LOC events also involve nonrecoverable malfunctions or involve recoverable malfunctions 

with insufficient time and altitude to attempt or complete engine recovery. Therefore, in most 

PSM situations, thrust asymmetry is unavoidable and the primary crew objective is to control, 

not correct, the thrust asymmetry. 

3.11.1 Thrust Asymmetry Annunciation Potential Benefits and Risks. 

Engine Indication or alert annunciation of Thrust Asymmetry is problematic in that Thrust 

Asymmetry may, or may not, be due to a propulsion system malfunction. In addition, Thrust 

Asymmetry is nonspecific and does not aid the crew in determining which engine is 

malfunctioning or why the engine is malfunctioning. There are sufficient potential risks 

associated with Thrust Asymmetry annunciation (including nuisance alerts) to outweigh the 

potential benefit. Additionally, there are easier and more effective means of addressing the 

problems caused by Thrust Asymmetry (e.g., LOC). Thrust Asymmetry occurs as the result of a 

significant thrust shortfall or overthrust. Of the PSMs which underlie significant Thrust 

Asymmetry, all except Stuck Throttle, can be sensed as thrust shortfall or overthrust. Stuck 

Throttle is a concern only when it occurs with autopilot engaged. There are no autothrottle or 

autoflight control laws that use split throttle or differential thrust. Therefore, split throttle/thrust 

is reliably detectable if throttle lever position or engine thrust is known/sensed and compared. 

The goal of any Thrust Asymmetry indication or annunciation should be to make consequential 

Thrust Asymmetry intuitively obvious at the airplane level versus the engine system level. 

Thrust Asymmetry may be best indicated to the crew on the Primary Flight Display where its 

effects for most PSM events must generally be addressed through airplane-level control. 

3-17
Risks Associated with False Detection and Annunciation were not assessed, and Risks 

Associated with Failure to Detect were not assessed. 

3.11.2 Confidence of Correct Thrust Asymmetry PSM Detection. 

Thrust Asymmetry is an airplane system response to individual PSM events or conditions. The 

primary consideration for detecting thrust asymmetry is confidence in determining thrust from a 

given engine. Thrust asymmetry is defined as a prescribed difference in the validated thrust 

levels from the individual engines. The detection of Thrust Asymmetry, as defined above, is 

considered highly feasible. 

The difference in validated thrust may, or may not be, due to an engine malfunction. This 

ambiguity adds risk to detection. 

The risks in the current methods to detect a deviation in commanded to actual thrust, described 

in section 3.7, must be reiterated. The models used to determine a difference in commanded to 

actual thrust are based on a relationship of an indicated parameter for a healthy engine at steady 

state. If the PSM can be detected with this model, the risk is low. Again, this qualifier further 

supports the application of the Time Lag Rule to detection methods designed to mitigate the risk 

of ICR due to PSM. 

3.12 THE PSM BENEFIT, DETECTION POTENTIAL, AND RISK SUMMARY. 

The potential operational benefit of PSM annunciation, detection potential and risk, and 

operational risk are summarized as follows: 

• Powerloss in the form of Engine Failure (subidle/flameout/etc.). High potential 

operational benefit and effectiveness. Low detection and operational risk. 

• Powerloss in the form of Thrust Shortfall (actual thrust less than commanded thrust). 

High potential operational benefit and effectiveness. Low detection and operational risk. 

• Surge Recoverable with Crew Action and Surge Nonrecoverable. High potential 

operational benefit and effectiveness. Moderate to high detection risk and low to 

moderate operational risk. Surge or any other engine malfunction annunciation on 

ground above V1 may introduce operational risk that could outweigh any potential 

benefit of such annunciation. 

• Failed Fixed Thrust in the form of Thrust Shortfall (actual thrust less than commanded 

thrust). High potential operational benefit and effectiveness. Low detection and 

operational risk. 

• Failed Fixed Thrust in the form of Overthrust (actual thrust greater than commanded 

thrust). High potential operational benefit and effectiveness. Low detection and 

operational risk. 

3-18
• Failed Fixed Thrust in the form of Stuck Throttle. High potential operational benefit and 

effectiveness. Low detection and operational risk. Potential safety benefit is to be 

developed/determined (TBD). 

• High Vibration. Potential operational benefit of annunciation varies because high 

vibration may or may not be malfunction-related. Moderate potential effectiveness. 

Moderate detection and low operational risk. 

• Thrust Asymmetry. Unknown/indeterminate potential operational benefit. Low 

annunciation effectiveness. Unknown/indeterminate operational risk. High detection 

potential. Indeterminate meaningful detection potential and moderate detection risk of 

meaningful thrust asymmetry. Indeterminate operational risk. 

3-19/3-20
4. OPERATIONAL ASSESSMENT—TASKS 2.1, 1.2, 6.2, AND 6.1. 

4.1 IN-SERVICE DATA ASSESSMENT (TASK 2.1). 

As part of an FAA research contract, the BCA Flight Deck and Propulsion groups reviewed and 

analyzed PSM+ICR event data to investigate the potential of Flight Deck engine malfunction 

annunciations to prevent or reduce UCR to certain PSMs. 

4.1.1 Research Objective and Goal. 

The principal research objective was to evaluate PSM+ICR events, identify contributing factors, 

assess the detection and prevention potential (PP) of PSM annunciations, and establish a 

framework for understanding UCR to PSM. The principal goal was to promote understanding of 

these events and develop recommendations pertaining to Propulsion System sensing and Flight 

Deck indication in general, and PSM detection and Flight Deck annunciation in particular. It 

was intended that the recommendations transcend specific aircraft models, design, and 

operational philosophies to the maximum extent possible and practicable. 

4.1.2 Task 2.1 Overview and Background. 

“PSM+ICR [Propulsion System Malfunction Plus Inappropriate Crew Response] is now the 

dominant contributor (25 percent of hull loss and fatal accidents over the past 5 years [mid 

1990s]) to propulsion-related turbofan and turboprop airplane accidents.” [Flight Safety 

Foundation (FSF) PSM+ICR Report Section 2 Introduction page 6.] For the 10-year period, 

1992 to 2001, PSM+ICR events are the largest single contributor to propulsion-related turbofan 

and turboprop airplane accidents. PSM+ICR alone accounts for 26.5% of all propulsion systemrelated accidents [Boeing Propulsion System Accident Statistic Summary]. 

Task 2.1 consisted of: 

• A detailed in-depth review and analysis of the 80 in-service turbofan events in the AIA 

and European Association of Aerospace Industries (AECMA) joint 1998 Project Report 

on PSM+ICR.*

• A review and analysis of post-AIA report in-service PSM data and PSM+ICR events. 

 

*

It is assumed that the 80 AIA report events do not document the total population of PSM+ICR events, but that they

are reasonably representative of the overall nature and distribution of PSM+ICR events. 

4-1
The overall objective of these reviews was to achieve an in-depth understanding of PSM+ICR 

events and assess the potential of Flight Deck engine indications, annunciations, and procedures 

to address UCRs to PSMs. Specific tasks were to: 

• determine if the lack or availability of propulsion malfunction indications and 

annunciations/alerts were contributing factors in the crew responses that occurred in 

these events. 

• identify other event factors contributing to the crew responses that occurred in these 

events. 

• identify the safety concerns associated with each major malfunction and crew response. 

• identify potential solutions and develop recommendations regarding UCRs to PSMs. 

Review of the AIA PSM+ICR Report events produced the following products: 

• A set of potential Flight Deck PSM annunciation/alert changes. This set was provided to 

task 1.2 for operational assessment of their potential to address the crew response-related 

safety concerns identified in task 2.1. 

• A set of malfunction-related recommendations. This set was provided to propulsion for 

Task 5.1 Malfunction Characterization and propulsion Task 5.2 Malfunction 

Investigation and Study for detection potential. 

Boeing and other databases were reviewed for post-AIA report in-service PSM and PSM+ICR 

events. Available event data were reviewed for the period 1995 to 2001. The IFSD data were 

reviewed from 1995 to 2001. PSM data were analyzed and reported for 2000 and 2001. 

The objective of the data reviews was to: 

• validate and complement the task 2.1 report conclusions and recommendations that 

resulted from reviewing the AIA report events. 

• provide additional insight into PSMs in general, and PSM+ICR events in particular, 

which would support and guide efforts to reduce PSM+ICR events in the current and 

projected in-service fleet. 

The PSM data review included: 

• examining the current Boeing fleet for PSM and PSM+ICR events in general, and for 

Surge, Powerloss, Engine Fail, and Vibration events in particular. 

• producing an overall quantitative sense of the distribution of PSM events in general, and 

Surge, Powerloss, Engine Fail, and Vibration events in particular, for the Boeing inservice fleet. 

4-2
• identifying post-AIA Report PSM+ICR events. 

• putting the PSM+ICR events into numerical perspective and context, i.e., 

supported/enabled event frequency and conditional probability calculations. 

The IFSD data reviewed documents cross-model and model-specific IFSD events from 1995 to 

2001, and documents the PSMs involved in 2000 and 2001. The IFSD review also documented 

engine restart/recovery in general, and Surge-related IFSD and restart/recoverability in 

particular. 

4.1.3 Discussion of Inappropriate Crew Response. 

The AIA report does not include a complete definition or characterization of ICR. ICR is a 

useful, but potentially misleading term. Crew response, particularly to system malfunctions, is 

part of a larger system of aircraft operation wherein the primary crew responsibility is to fly the 

airplane. Inappropriate, when used to describe crew response, may be misleading when 

implying crew blame, and by implying that the resolution of such occurrences rests solely or 

primarily with crew changes or qualifications. Crew response should be viewed in a system

context and may be more effectively addressed through a broader combination of design, 

training, operations, and procedure changes. 

Based on a review of the AIA report events, it would be inappropriate to generally assume or 

infer that the crew response in all the AIA report events was wrong or egregious. In some cases, 

crew response may have been wrong or egregious. But in many other cases, the crew action 

taken can be viewed as the most appropriate course of action under the existing circumstances, 

given the available information and time. Regardless, most of the AIA report event crew 

responses are considered undesirable. 

Based on AIA report events, the apparent definition of ICR is any PSM event where the crew 

failed to follow the published PPP in a timely manner. Thus, the following situations would be 

considered UCRs: 

• The crew wittingly or unwittingly executed the wrong PPP for the situation. 

• The crew wittingly or unwittingly executed the PPP incorrectly. 

• The crew executed the correct PPP for the wrong reason(s). 

• The crew intentionally deviated from PPP given the situation and information available. 

• The crew encountered a situation where the PPPs, or the circumstances/information for 

their application, were vague, incorrect, conflicting, or nonexistent. 

Any definition or term for UCR should avoid the need to subjectively judge the advisability of 

the crew actions in an event. Rather, the definition should provide an objective basis for 

collecting data for the study and prevention of such UCR. Event data can therefore include 

events where the crew was provided insufficient information and inadequate procedures, as well 

4-3
as events where the crew exhibited unacceptable performance. Regardless, data collection and 

study is greatly facilitated by unqualified crew support, and such support is better assured by 

neutralizing the issue. It has been suggested, and is therefore recommended, that wherever it is 

possible to do so without confusion, the term Crew Response (CR) or Propulsion System

Manlfunction+Crew Response (PSM+CR) be used to identify safety, accident, and incident 

events where the combined malfunction and crew response were contributing factors. There is 

little chance for confusion or problem when these terms are used in the context of safety, 

accident, or incident issues which require attention and resolution. 

4.1.4 Task 2.1 Review and Analysis Methodology. 

This section describes the review and analysis methodology and includes discussion of the AIA 

report event data and PSM+ICR category characterizations and related conclusions. 

4.1.4.1 The AIA PSM+ICR Report Data Review and Analysis. 

Each AIA PSM+ICR Report event was individually reviewed. The circumstances and factors in 

each event were analyzed from an operational perspective to assess if and how the PSM, PSM 

effects, crew awareness or lack of awareness, and other factors present influenced the crew 

response. The AIA report event analysis was limited to the AIA report events and is therefore 

primarily operational, not statistical. There was no formal analysis of the data for statistical 

significance. Such analyses for statistical significance would have required additional 

information and effort beyond the scope of this work. 

In general, the PSM, PSM effects, crew knowledge/awareness, and the role of various other 

factors were assessed for significance in the crew response that occurred. Specifically, for each 

event, what could be determined in the following areas was documented and assessed for 

relevance to PSM detection and Flight Deck indications and annunciations. 

• Recoverability or nonrecoverability of the PSM 

• Engine indication(s) availability and use 

• PSM annunciation(s) presence and use 

• Cues (aural, tactile, and visual) presence and use 

• Autopilot/Autothrottle engagement 

• Thrust Asymmetry 

• Crew intent, i.e., was the crew response intentional or unintentional 

Conservatively, where explicit information was not provided or available, significance was listed 

as unknown. Assumptions were made or conditions were inferred only where it was reasonably 

reliable to do so. For example, it was assumed that autopilot was not engaged for takeoffs and 

that LOC events were not intentional. 

The majority of events appeared to involve crews that are well within the range of acceptable 

crew qualification and competency. Therefore, a basic assumption is that the crews involved in 

these events are qualified and competent to at least a minimum acceptable level. Based on this 

assumption, to a limited extent, crew awareness or lack thereof was sometimes inferred. For 

4-4
example, even a minimally or marginally competent flight crew is expected to understand the 

importance of maintaining engine out minimum control airspeed, attitude control, and engine 

parameters balanced or within operating limits. Therefore, in incidents where the flight crew 

failed to maintain these things, it was generally inferred that the crew was unaware of the 

condition—at least for some period of time. Lack of awareness was either explicitly reported, or 

patently obvious, in many events. Such lack of awareness usually occurred where 

• there was no explicit annunciation or alert for the PSM involved, 

• the PSM was masked by low power, autothrottle, or autopilot, or 

• the PSM symptoms were easily interpretable as some other non-engine-related condition, 

i.e., lent themselves to such misdirection as a tire, gear, structure, or nonengine airplane 

system problem. 

Based on the event data review and analysis, associated safety concerns and recommendations 

were developed regarding 

• potential Flight Deck annunciations that should be assessed for operational 

appropriateness and potential effectiveness, and 

• PSMs that should be investigated and studied to determine detection potential. 

4.1.4.2 The PSM and IFSD Data Review. 

The PSM data review included: 

• Each PSM event was reviewed in detail to ensure characterization consistent with AIA 

report events. 

• The overall frequency/distribution of PSM Symptoms was numerically quantified, 

combined with fleet statistics, and used to calculate various estimated rates of PSM and 

PSM+ICR occurrence. 

• Surge recoverability, powerloss, and IFSD analyses were accomplished. 

• Specific post-AIA report PSM+ICR events were identified. 

4-5
An In-Flight Shutdown data review was used to document and chart 

• the overall frequency and distribution of PSM Symptoms associated with 2000 and 2001 

IFSDs and 

• an IFSD restart analysis. 

4.1.5 The Review and Analysis of AIA PSM+ICR Report Events. 

This section includes a general discussion of the AIA report event data, PSM+ICR category 

characterizations and related conclusions, AIA PSM+ICR Report event analyses and related 

conclusions, and general and specific PSM+ICR-related safety concerns based on the preceding 

event analyses. 

4.1.5.1 The PSM+ICR Report Events Overview. 

The AIA PSM+ICR Report consisted of 80 turbofan events divided into four CR categories: 

LOC (11 events), Other (13 events), Rejected Takeoff (30 events), and SDTGE (27 events). 

The AIA PSM+ICR Report documented the PSM Symptoms in these 80 turbofan events as a 

percent of total. Per the AIA report, five Symptoms represent 91% of the PSMs involved in 

ICR: Compressor Stall/Surge (63%), Powerloss (14%), Stuck Throttle (6%), Fire Warning (5%), 

and No Response to Throttle Command (3%). 

Except for some other top-level phase of flight and geographic region event distribution 

summaries, charts of airplane generation versus hazard, and chronological accident rate charts, 

the AIA report contains no additional turbofan event data reduction. 

It was a task 2.1 objective to review and analyze the AIA report events in-depth to achieve 

understanding sufficient to identify the contributing event factors and assess the potential of 

Flight Deck engine indications, annunciations, and procedures changes to address the ICRs 

observed. The following sections document that review and analysis. 

4.1.5.2 The PSM+ICR Category Characterizations and Related Conclusions. 

The in-service data used in the PSM+ICR report consisted of 80 turbofan events divided into 

four CR categories: LOC, Other, RTO, and SDTGE. The following sections characterize those 

categories and document related conclusions. 

4.1.5.2.1 Loss of Control Event Characterization and Related Conclusions. 

Most LOC events involved significant thrust asymmetry and low airspeed or unusual attitude at 

the time control is lost. All 11 LOC events involved thrust asymmetry as a contributing factor. 

Thrust asymmetry, while a contributing factor, was not however the root/primary cause of LOC. 

Two of eleven events primarily failed to maintain or control airspeed, and seven of eleven other 

events primarily failed to maintain or control attitude. As a secondary factor, most events 

involving failure to maintain and control attitude also resulted in failure to control airspeed (both 

4-6
high and low). The remaining two events were on-ground Reverse Thrust events involving the 

rapid development of thrust asymmetry following a PSM, where airspeed and attitude control 

were not factors. LOC events predominately involved failure to maintain airplane airspeed and 

control airplane attitude. 

The LOC event data indicated that airspeed and attitude awareness and control has potential for 

ICR prevention and risk mitigation in this category. Therefore, principal design and operational 

emphasis should be placed on airspeed and attitude awareness and control in events involving 

thrust asymmetry. LOC event data further suggested that engine malfunction annunciations that 

identify the presence of a PSM and identify the affected engine(s) also have potential for ICR 

prevention and risk mitigation. Note that these observations are particularly true for a singleengine go-around. 

4.1.5.2.2 Other (O) Event Characterization and Related Conclusions. 

The 13 Other events consisted of 4 Engine Surge events, 5 Engine Fail/Surge events, 1 Engine 

Fail/Subidle event, 2 Excess Vibration events, and 1 Engine Shutdown for low oil quantity 

event. The Other events are categorized and described below to provide understanding of the 

type and nature of events in this category. 

Seven of thirteen events involved failure to follow proper procedure or operating practice, a 

misidentification of failure, or failure to detect a PSM. 

• Two events involved a rushed approach and long landing, with runway excursions. It 

was unclear if, but unlikely that, an added PSM annunciation would have affected the 

outcome of these two events. 

• Three other events involved failure to follow nonnormal engine shutdown procedures: 

one failure to shutdown and two improper shutdown procedures. In the two improper 

shutdown procedure events, the crew identified and shutdown the malfunctioning engine, 

but failed to follow the correct shutdown/secure procedure. It is possible, but 

questionable, that lack of annunciation linked to a specific procedure contributed to the 

crew responses. The crew knew they had a PSM and knew the correct engine. Further 

annunciation does not appear to offer any benefit. 

• In one takeoff event, the crew properly rejected takeoff at approximately 80 kts, but 

misidentified a nonrecoverable PSM noise, vibration, and surge as a tire failure. Even 

though the crew took the correct action, this event was classified as ICR because the crew 

misidentified the failure and RTOed for the wrong reason. This event illustrates lack of 

correct interpretation and understanding that explicit annunciation can provide. 

• In one cruise phase event, the crew failed, over a period of 7 minutes, to detect loss of 

thrust on an engine and consequent loss of airspeed from 250 to 180 knots. After an 

autothrottle power reduction, the engine had failed to respond to autothrottle power-up 

command. The crew successfully intervened when the autopilot, unable to hold altitude 

and track, finally disconnected. This incident illustrates the potential for lack of crew 

4-7
detection and awareness due to automation masking of the malfunction. Similar events 

have resulted in LOC because the crew was unprepared to handle the automation 

disconnect. Explicit PSM annunciation can provide more timely crew awareness. 

Of the remaining 6 of 13 events: 

• Two events involved a low-altitude takeoff dual-engine surge and powerloss on a twoengine aircraft, where the crew failed to reduce power on one or both surging engines. In 

both events, dual/all engines were malfunctioning on a two-engine aircraft at low 

altitude. It is possible that Surge annunciations and associated procedures might have 

provided sufficient crew awareness and response to prevent the resulting Hull Losses and 

fatalities. 

• One event, control flight in terrain (CFIT), continued takeoff after surge and powerloss 

below V1. A second same-side engine was shutdown after takeoff for Fire Warning. 

The aircraft failed to gain altitude and crashed 5 miles from the runway. 

• One event involved RTO and subsequent crew Shutdown of Good Engine based on 

information from the air traffic control (ATC). The malfunctioning engine (compressor 

blade failure) continued to vibrate the aircraft until the engine shut itself down. 

• One event involved excess pitch and stickshaker at liftoff after a single-engine powerloss. 

• One event involved a 3-minute period where the crew could not reliably determine which 

engine on a two-engine aircraft was continually surging. 

Some of these Other events are questionable PSM-related ICR (e.g., the rushed approaches and 

failures to shutdown or complete shutdown procedures). Some are questionable as ICR (e.g., the 

RTO for the wrong reason). But most events are relevant to the issues of PSM-related ICR in 

that they illustrate an apparent lack of crew awareness or correct understanding—contributing 

factors in most PSM+ICR events. Many events appear to indicate that the lack of PSM-related 

annunciation was a contributing factor in the crew response. In other events, the data suggested 

that the lack of PSM annunciations is, or may have been, a contributing factor in the crew 

response. 

The Other event data indicated and suggested that engine malfunction annunciations that identify 

the presence of a PSM and identify the affected engine(s) offer potential for ICR prevention and 

risk mitigation in this category. 

4-8
4.1.5.2.3 Shutdown Good Engine Event Characterization and Conclusions. 

There were 22 events where the crew shutdown a good engine, i.e., an engine that was not 

malfunctioning. Some of these shutdowns were intentional, i.e., the crew shutdown the engine 

they had mistakenly identified was malfunctioning. In other events, good engine shutdowns 

were unintentional, i.e., the crew correctly identified the malfunctioning engine but mistakenly 

shutdown a different, properly functioning engine. In most cases, crew intent can be reliably 

determined. In-flight, all good engine shutdowns on two-engine aircraft were intentional. On 

three- and four-engine aircraft, there were a mix of intentional and unintentional good engine 

shutdowns. 

Of the 22 Shutdown Good Engine events, 9 were intentional, 6 were unintentional, and 7 were of 

unknown intention (3 appear intentional, and 4 appear unintentional). All but 1 of the 22 

Shutdown Good Engine events occurred in flight (see table 4-1). In the one on-ground Good 

Engine Shutdown event, the crew shutdown both engines on a two-engine aircraft, and it cannot 

be determined from event data if the crew did so intentionally or unintentionally. 

TABLE 4-1. CREW INTENT—SHUTDOWN GOOD ENGINE 

Number of Engines Two Three Four 

Number Events 7 2 13 

Crew Intent 

(To Shutdown Good Engine) 

6 Intentional (In Flight) 

1 Unknown (On Ground) 

2 Unknown 4 Intentional 

5 Unintentional 

4 Unknown 

Ninety-three percent of the three- and four-engine aircraft were three-crew aircraft (14 of 15). 

Flight engineer errors were cited in 3 of 15 events and were possible in another 3 of 15. All 

flight engineer errors were unintentional engine rundowns or shutdowns. The extent to which 

three-crew interaction, delegation of responsibility, and flight engineer panel interface issues 

were contributing factors in the engine shutdown is unknown. 

There were five Throttled Good Engine (TGE) events. All occurred on two-engine aircraft 

during takeoff rotation or takeoff climb. Three appear intentional, and two appear unintentional. 

The Shutdown/Throttled Good Engine (SDTGE) event data indicate that engine malfunction 

annunciations that identify the presence of a PSM and identify the affected or unaffected 

engine(s), particularly on two-engine aircraft, has potential for ICR prevention and risk 

mitigation in this category. 

4.1.5.2.4 RTO>V1 Event Characterization and Related Conclusions. 

Of the 30 RTO events, 27 involved RTO above the V1 takeoff decision speed, many of which 

involved runway excursions (off the side or overrun). The remaining three events were two 

aborts below V1 and one abort at V1, all of which overran the runway end due to crew braking 

procedure errors (see table 4-2). 

4-9
TABLE 4-2. REJECTED TAKEOFF POINT RELATIVE TO V1, ROTATION, AND LIFTOFF 

RTO< or at V11, 4 RTO>V14

 < Rotation2 RTO at Rotation RTO>Liftoff 

3 (1 H, 2 S) 18 (2 H, 5 S, 11 I) 6 (3 S, 3 I) 3 (1 HF3, 2 H) 

1. There were two events where the RTO occurred below V1, and one event where the RTO occurred at V1. All three 

events overran the runway end due to crew braking-related errors. 

2. In one event, the flight officer flying attempted to RTO. The captain intervened and the takeoff was successfully

completed. 

3. The one HF event PSM initiated, and the abort occurred after liftoff. 

4. 37% of the RTO events (11 of 30) occurred approaching, at, or just past V1. 

S = substantial damage 

I = incidental damage 

H = Hull Loss without fatalities

The event database indicated that there are many different contributing factors to RTO runway 

overruns. Poor crew communication and coordination, poor/delayed crew braking, thrust 

reverser lockouts per minimum equipment list dispatch, failure to deploy spoilers, poor weather 

and contaminated runway conditions (e.g., snow, rain, and ice), Captain Pilot Not Flying (PNF), 

transfers of control confusion, many malfunctions at or near V1, etc. In a few events, the PSM 

for which the crew rejected takeoff also reduced thrust reverser capability. 

In 27% of the RTO events (8 of 30), the RTO was initiated on the basis of an indication light, 

annunciation/alert, or crew callout. 

• Three events involved ENGINE FAIL annunciations/alerts. 

• Three events involved FIRE WARNING annunciations/alerts or callouts. 

• One event involved a THRUST REVERSER UNLOCK indication. 

• One event involved an EGT exceedance indication/annunciation. 

The RTO event data indicated that malfunction annunciations above V1 are a contributing factor 

in RTO>V1. This suggests that inhibiting such annunciations from V1 to some point after liftoff 

has potential for ICR prevention and risk mitigation in this category. The data suggested that 

malfunction annunciation to prevent RTO>V1 might increase, not reduce, the risk of RTO>V1. 

4.1.5.3 The AIA PSM+ICR Report Event Analyses and Related Conclusions. 

4.1.5.3.1 Overall PSM and Hazard Analysis. 

Table 4-3 summarizes the primary malfunctions/symptoms and hazard associated with each crew 

response category: LOC, Other, RTO, and SDTGE. Note that other, secondary, 

malfunctions/symptoms such as vibration may also be present in these events. Table 4-3 also 

shows the average numerical hazard, number of fatalities, and recoverability associated with 

each crew response category. Of the 81 events, 12 involved HF, 11 involved H, 11 involved S, 

and 47 were I. Figure 4-1 charts the type and occurrence of PSMs listed in table 4-3. Figure 4-2 

charts the CR associated with each PSM listed in table 4-3. 

4-10
TABLE 4-3. CREW RESPONSE, MALFUNCTIONS, HAZARD, AND 

PSM RECOVERABILITY 

CR and Primary PSM/Symptom Hazard 

Numerical 

Hazard 

Number of 

Fatalities PSM Recoverability

Loss of Control (11) 

Powerloss (7) 

 5 Engine Fail w/Surge 

 1 Engine Subidle 

 1 Unknown 

Stuck Throttle (2) 

 1 at Climb power 

 1 at Idle power 

Thrust Reverser (2) 

 2 Fail to Deploy

7 HF, 2 H, 1 S, 1 I 

5 HF, 1 H, 1 S 

4 HF, 1 H 

1 S 

1 HF 

2 HF 

1 H, 1 I 

4.36 336 (7 events) 3 R, 5 NR, 3 Unknown 

CR and Primary PSM/Symptom Hazard 

Other (13) 

Powerloss (6) 

 5 Engine Fail w/Surge 

 1 Engine Fail/Subidle 

Surge (4) 

Excess Vibration (2) 

Low Oil Quantity (1) 

3 HF, 3 H, 0 S, 7 I 

2 HF, 1 H, 3 I 

2 HF, 1 H, 2 I 

1 I 

1 HF, 1 H, 2 I 

2 I 

1 H 

2.69 44 (3 events) 0 R, 11 NR, 2 

Unknown 

CR and Primary PSM/Symptom Hazard 

Shutdown/Throttled Good 

Engine (27) 

Surge (14) 

Powerloss (6) 

4 Thrust Shortfall 

Stuck Throttle (3) 

 1 at Idle 

 1 at Medium to High 

 1 at High 

Fail Fixed/Subidle (1) 

Excess Vibration (1) 

Fire Warning (2) 

1 HF, 1 H, 0 S, 25 I 

1 HF, 1 H, 0 S, 12 I 

6 I 

3 I 

1 I 

1 I 

2 I 

1.961 47 (1 event) 10 R, 14 NR, 3 

Unknown 

Shutdown 3

Throttled 4

CR and Primary PSM/Symptom Hazard 

RTO>V1 (30) 

Surge (19) 

Powerloss (6) 

2 Engine Fail w/Surge 

3 Thrust Shortfall 

1 Perceived 

Warning/Indication (4) 

Severe Vibration (1) 

1 HF, 5 H, 10 S, 14 I 

1 HF, 3 H, 6 S, 9 I 

1 H, 2 S, 3 I 

1 H, 2 S, 1 I 

1 I 

2.33 2 3 (1 event) 5 R, 16 NR, 9 

Unknown 

1. Numerical Hazard: Shutdown Good Engine on two-engine aircraft = 2.14. Shutdown Good Engine on same side as malfunctioning engine 

on four-engine aircraft = 2.0. Throttled Good Engine on two-engine aircraft = 1.6. 

2. Numerical Hazard for RTO with wheels on ground (i.e., RTO before liftoff) is 2.15. 

3. Recoverability vs Nonrecoverability: Shutdown Good Engine = 7 R, 13 NR, 2 unknown. 

4. Recoverability vs Nonrecoverability: Throttled Good Engine = 3 R, 1 NR, 1 unknown. 

R = Recoverable 

NR = Nonrecoverable 

4-11
0

5

10

15

20

25

30

35

40

Surge

Po

werloss

Indication/Alert

Fail Fixed

Thrust

High Vibration

Low Oil Qty

Misc

Propulsion System Malfunction

Numb

er of Occurrences 

FIGURE 4-1. THE AIA REPORT PROPULSION SYSTEM MALFUNCTIONS 

0

5

10

15

20

25

Surge Powerloss Indication/Alert Fail Fixed

Thrust

High Vibration Misc

Propulsion System Malfunction

Number of Occurren

c

e

s

LOC

Other

SDTGE

RTO>V1

FIGURE 4-2. THE AIA REPORT CREW RESPONSE CATEGORY AND PSM 

Table 4-3 is sorted by ICR with the greatest number of HF events, then with the greatest number 

of overall fatalities. The event database included numerical hazard levels 1 through 5 assigned 

to each event. These values were used to calculate an average numerical hazard for each CR 

category. The average numerical hazard is greatest for LOC, followed by Other, RTO>V1, and 

SDTGE. Excluding TGE events, the average numerical hazard for SDGE on a two-engine 

aircraft equals 2.14. Excluding RTOs after liftoff, the average numerical hazard for RTO>V1 

equals 2.15. The event data indicated that there are no fatalities for RTO>V1 when the RTO is 

initiated on ground. There were three RTO>V1 events that initiated after liftoff. Only one of 

these three RTOs after liftoff involved fatalities. That one event accounts for all three RTO>V1 

fatalities. 

The average numerical hazard listed in table 4-3 is based on individual event numerical hazards 

whose assignment/determination are subjectively assigned values. Therefore, numerical hazard 

is not considered an objective measure of actual hazard and was included only for rough order of 

magnitude comparisons. For the purposes of this analysis, the number of fatalities was 

4-12
considered the primary objective measure of the actual and potential hazard, and the potential 

safety benefit, associated with each CR category. 

With respect to reducing PSM-related ICR using PSM annunciations, the hazards and fatalities 

for events in each CR category suggest: 

• The greatest potential safety benefit is in addressing LOC, Other, and SDTGE-related 

PSMs and events. 

• The least potential safety benefit is in addressing RTO>V1-related PSMs and events. 

4.1.5.3.2 Recoverable Versus Nonrecoverable Engine Malfunctions. 

Recoverable (R) engine malfunctions are those events/cases where the engine automatically, or 

with crew action, recovers to commanded thrust and full range of functionality/performance. 

Most R events involve no engine component failures and no significant engine damage. 

Nonrecoverable (NR) engine malfunctions are those events/cases where the engine or engine 

controller will not automatically, or with crew action, recover to a normal level of

functionality/performance. Typical NR events involve sense line or controller failures, foreign 

object damage, a failure of blades, seals, bearings, controllers, etc., or significant engine damage. 

Of the 81 AIA report event ICRs, table 4-4 shows that 22% involved R PSMs (18 of 81), 57% 

involved NR PSMs (46 of 81), and recoverability could not be determined in the remaining 21% 

of events (17 of 81). Overall, and in each ICR category, the majority of event PSMs are NR. In 

HF events, 17% involved R PSMs (2 of 12), 58% involved NR PSMs (7 of 12), and 

recoverability could not be determined in the remaining 25% of events (3 of 12). It is known 

that in one of the three HF events where recoverability is unknown, the malfunctioning engine 

was not operating when the aircraft struck the ground. The engine-operating state at the time of 

impact is not known in the remaining two events. 

TABLE 4-4. PROPULSION SYSTEM MALFUNCTION RECOVERABILITY 

Recoverable PSM Nonrecoverable PSM Unknown 

All Events (81) 18 46 17 

HF Events (12) 2 7 3 

The AIA report PSM recoverability data suggested that both R and NR PSMs, but 

nonrecoverable PSMs in particular, should be investigated for detection potential. 

4.1.5.3.3 Overall Summary of Number of Crew and Number of Events Versus Number of 

Engines. 

Of the 80 AIA report events, 12 involved HF, 11 involved H, 11 involved S, and 46 were I. 

4-13
Of the 80 event aircraft, 43% were two-engine aircraft (34 of 80), 16% were three-engine aircraft 

(13 of 80), and 41% were four-engine aircraft (33 of 80). Eighty-eight percent of the two-engine 

aircraft were two-crew aircraft (30 of 34). Ninety-two percent of the three-engine aircraft (12 of 

13) and 91% of the four-engine aircraft (31 of 33) were three-crew aircraft with flight engineer. 

All of the three- and four-engine, two-crew aircraft events were incidents. 

Table 4-5 shows that most of the two-crew aircraft involved in AIA report events are two-engine 

aircraft. Only three of the three- and four-engine aircraft involved in AIA report events were 

two-crew. 

TABLE 4-5. NUMBER OF CREW AND NUMBER OF EVENTS VERSUS NUMBER OF 

ENGINES ON AIRCRAFT 

Number of Engines Two Three Four 

Number of Flight Crew 88% Two Crew 

(30 of 34) 

92% Three Crew 

(12 of 13) 

91% Three Crew 

(31 of 33) 

Number of ICR Events 43% (34 of 80) 16% (13 of 80) 41% (33 of 80) 

The AIA report event data indicated that PSM+ICR is not limited to engine number or crew size. 

4.1.5.3.4 Overall Summary of Engine Type (HBPR Versus LBPR) Versus Events. 

Table 4-6 shows that 61% of all events involved high by-pass ratio (HBPR) engines (49 of 80). 

Thirty-nine percent of all events involved low by-pass ratio (LBPR) engines (31 of 80). 

TABLE 4-6. EVENTS VERSUS ENGINE TYPE 

Engine Type HBPR LBPR 

All Events 61% (49 of 80) 39% (31 of 80) 

The engine type data suggested that PSM detection potential investigation and study should 

include both HBPR and LBPR turbofan engines. However, the existing and future fleet trend 

towards predominately HBPR engines suggested there is more potential benefit in focusing on 

HBPR engines. 

4.1.5.3.5 Surge and Powerloss Events. 

The AIA/AECMA Project Report documents that Surge and Powerloss events account for 77% 

of the PSMs observed in the event database. It is often not clear from event data if Surge or 

Powerloss is the initial PSM symptom. Both usually follow from some primary failure, e.g., a 

seal, bearing, blade, controller, fuel flow loss, or other such failure. In many cases, Surge is a 

secondary PSM symptom that results from rapid engine deceleration. 

4-14
Surge and Powerloss events can be characterized as either R or NR. Table 4-7 shows that 51% 

of the RTO, SDTGE, and Other Surge events were NR. Twenty-seven percent were R either 

without or with crew action. It is not known how many R surges require, or do not require, crew 

action to recover. In general, most 

• NR engine surges are accompanied by significant sustained powerloss or an engine 

subidle condition, and 

• R engine surges are not accompanied by significant or sustained powerloss. 

TABLE 4-7. THE AIA PSM+ICR REPORT SURGE EVENTS RECOVERABILITY 

R NR Unknown

RTO, SDTGE, and Other AIA 

Report Surge Events 

27% (10 of 37) 51% (19 of 37) 22% (8 of 37) 

4.1.5.3.5.1 Surge Events. 

Surge events were the main PSM in RTO>V1 and SDTGE, and a minor PSM in Other events. 

There were 37 RTO, SDTGE, and Other Surge events. Table 4-7 shows that 27% were R (10 of 

37), 51% were NR (19 of 37), and recoverability could not be determined in 22% of the events 

(8 of 37). It was not determined how many R surges did or would have recovered without crew 

action versus with crew action. 

4.1.5.3.5.2 Powerloss Events. 

As table 4-3 shows, Powerloss events were distributed evenly across all event categories: LOC, 

Other, RTO>V1, and SDTGE. Table 4-8 shows that where recoverability from Powerloss can be 

determined, most Powerloss events were NR. 

TABLE 4-8. POWERLOSS RECOVERABILITY 

R NR Unknown

Powerloss Events 16% (4 of 25) 52% (13 of 25) 32% (8 of 25) 

The Surge and Powerloss event data suggested that both R and NR Surge and Powerloss should 

be investigated and studied for detection potential. The data also suggested more potential ICR 

prevention and risk mitigation benefit in focusing on NR Surge and Powerloss. 

4.1.5.3.6 Flight Phase, Altitude, and Power. 

Table 4-9 shows that most of the 80 PSM events initiated during the Takeoff and Climb phase of

flight. Most (67%) of the HF events occurred at relatively low altitudes in climb after takeoff or 

during go-around. However, 33% of the 12 HF events in the AIA report database initiated in 

other (lower power) flight phases. Sixty-seven percent of all HF events initiated at high 

(takeoff/climb) power between 50 and 2000 feet. Thirty-three percent of all HF events initiated 

4-15
at medium and low power. Note that the Cruise PSM event initiated at climb power, but the 

associated SDGE occurred at low engine power. 

TABLE 4-9. FLIGHT PHASE, ALTITUDE, POWER, AND EVENT CORRELATIONS 

Flight Phase 

Takeoff 

(Ground Roll) Climb Cruise Descent 

Approach/ 

Go-Around 

Number of Events 36 27 10 2 5 

Number of HF Events 0 8 11 1 22

HF Event Altitudes 0 50′ to 2000′

3 FL 290 7200′ 200′ to 300′

1. The Cruise PSM event initiated at Climb power, but the associated ICR (SDGE) occurred at low engine

power. 

2. The Descent and Approach PSM events initiated at Climb power, but the associated ICRs (LOC) occurred

at high/go-around power. 

3. Most appear to initiate below 500′.

As table 4-3 shows, most HF events were LOC (7 of 12), followed by Other (3 of 12), then 

SDGE (1 of 12), and then RTO (1 of 12). Note that the RTO event occurred after liftoff and has 

been included in the Climb phase in table 4-10 to differentiate ground and in-flight events. 

TABLE 4-10. FLIGHT PHASE, ALTITUDE, PSM SYMPTOM, AND 

HAZARD CORRELATION 

Flight Phase 

(Number of Events) 

Takeoff 

(Ground Roll) Climb Cruise Descent 

Approach/ 

Go-Around 

Surge (37) 17 15 5 - - 

Surge HF (3) 2 < 300′ 1 at FL2901

Powerloss (25) 10 7 5 1 2 

Powerloss HF (7) 5 < 2000′ 2 < 300′

2

Stuck Throttles (5) 2 1 2 

Stuck Throttles HF (2) 1 at 1500′ 1 at 7200′

1. PSM event initiated at Climb power, but the ICR (SDGE) occurred at low engine power. 

2. PSM events initiated at low to medium power, but the ICRs (LOC) occurred at high/go-around power. 

Fifty-eight percent of the 12 HF events were Powerloss (7 of 12), 2 of which also involved Surge 

effects. Twenty-five percent of the HF events were Surge (3 of 12), 2 of which also involved 

Powerloss. The remaining 17% of HF events involved Stuck Throttles (2 of 12). One Throttle 

Stuck at idle power in the Descent phase of flight, and one Throttle Stuck at climb power in the 

Climb phase of flight. 

4-16
Table 4-11 shows the distribution of events as a function of event category and phase of flight 

with notes that qualify the associated power settings. 

TABLE 4-11. EVENT CATEGORY VERSUS FLIGHT PHASE 

Flight Phase 

Takeoff 

(Ground Roll) Climb Cruise Descent Approach 

LOC (11)1 9 1 1 -

Other (13)2 5 7 1 - -

SDTGE (27)3 2 14 8 1 2

SDGE (7)4 1 3 (FL120-290) 1 - 2

RTO (30)5 27 3 (< 50′) - - -

1. Most LOC events involve high-power thrust asymmetry and low airspeed at the time control is lost. 

However, the majority of the PSMs in these LOC events (6 of 11) initiated in Cruise, Descent, 

Approach, and Landing at low to medium power levels and normal airspeeds and attitudes. The 

remaining 5 of 11 events initiated at Takeoff or Climb power levels and at normal airspeeds and

attitudes. 

2. All Other events involve high power/thrust levels: Takeoff, Go-Around, Climb, or maximum Cruise 

thrust. 

3. Most SDTGE events (20 of 27) are Climb, Cruise, Descent, and Approach phase events, not Takeoff 

phase high-power events. Seven of twenty-seven events are Takeoff phase events. All five TGE events 

are Takeoff phase events at or below 500 feet altitude. 

4. SDGE on two-engine aircraft. 

5. All RTO events occurred at Takeoff Power settings.

The data in tables 4-9, 4-10, and 4-11 suggest that all flight phases and power settings (low, 

medium, and high) should be considered in Flight Deck engine indication and PSM annunciation 

assessments and in Propulsion investigations/studies of malfunction detection potential. 

4.1.5.3.7 Thrust Asymmetry Role/Significance. 

Event data indicated that thrust asymmetry was a significant factor in the crew response in 19% 

of the events (15 of 81). Thrust asymmetry was not a significant factor in 69% of the events (56 

of 81). Significance could not be determined in 12% of the events (10 of 81): 4 TGE events, 2 

SDGE events, 2 Other events, and 2 LOC events. 

Thrust asymmetry was a significant factor in 5 HF, 4 H, 1 S, and 5 I events. Table 4-12 shows 

the relationship between thrust asymmetry, flight phase, and hazard. Table 4-13 shows the 

relationship between thrust asymmetry and the four CR categories. 

4-17
TABLE 4-12. SIGNIFICANT THRUST ASYMMETRY VS FLIGHT PHASE, PSM 

SYMPTOM, AND HAZARD 

Flight Phase 

(Number of Events) 

Takeoff/Landing 

(On Ground) Climb Cruise Descent 

Approach/ 

Go-Around 

Thrust Asymmetry

Significant to CR (15) 

4 4 3 1 3

 7 Powerloss 1 H 1 HF 1 S, 2 I 2 HF 

 4 Stuck Throttles 1 HF, 1 

I 

1 HF 1 I 

 3 Reverse Thrust 2 H, 1 I 

 1 Surge 1 H 

TABLE 4-13. SIGNIFICANT THRUST ASYMMETRY VS CREW RESPONSE 

CR LOC Other SDTGE RTO>V1

Thrust Asymmetry

Significant to CR (15) 

9 

(5 HF, 2 H, 1 S, 1 

I) 

2 

(1 H, 1 I) 

3 

(3 I) 

1 

(1 H) 

Nine of the eleven LOC events involved thrust asymmetry as a significant contributing factor. 

All HF events, and half of the H events involving significant thrust asymmetry were LOC events. 

However, as previously described, thrust asymmetry was not the root/primary cause of LOC. 

Most LOC events involve failure to maintain or control airspeed. Airspeed and attitude control 

were not factors in only two on-ground reverse thrust events involving the rapid development of 

thrust asymmetry following a PSM. 

Two of thirteen Other events involved thrust asymmetry as a significant contributing factor: one 

H and one I event: a reverse thrust-related runway excursion H event and a cruise engine subidle 

I event, where autopilot and autothrottle were engaged. It is unknown, but possible, that thrust 

asymmetry was a significant factor in two additional Other events: a CFIT HF event and an 

overpitch/stickshaker at rotation incident event. 

One Shutdown and two TGE events involved thrust asymmetry as a significant/contributing 

factor—all were incidents. The SDGE event involved a throttle stuck at idle combined with 

autothrottle engaged as a contributing factor in the shutdown of the good engine. 

One RTO>V1 H event involved thrust asymmetry as a significant/contributing factor. In this 

event, the flight officer, who was the pilot flying, overcorrected for the thrust asymmetry 

produced by the initial engine malfunction. This overcorrection apparently mislead the captain 

to believe that both engines on the two-engine aircraft were malfunctioning, and he initiated an 

RTO. A hull loss resulted. 

Analysis of thrust asymmetry in the AIA report event data indicated that prior to the 

development of a significant thrust asymmetry, there are earlier detectable symptoms of potential 

4-18
or impending thrust asymmetry. Specifically, such PSM symptoms as thrust shortfall, excess 

thrust, overthrust, and various autothrottle and engine control malfunctions. The data suggested 

that focusing on airspeed, attitude and PSM awareness, versus thrust asymmetry, represents 

greater potential for ICR prevention and risk mitigation. 

4.1.5.3.8 Autopilot and Autothrottle Role/Significance. 

4.1.5.3.8.1 Autopilot Significance. 

Event data indicated that the autopilot was a significant factor in the CR in 3 of 81 events (4%): 

2 LOC (1 HF and 1 S) and 1 Other (1I) event. In 71 of 81 events (88%), it could be reliably 

determined or inferred that the autopilot was not a significant factor in the CR. In 7 of 81 events, 

significance could not be determined. The autothrottle was engaged in all three events where 

autopilot was a significant factor. 

4.1.5.3.8.2 Autothrottle Significance. 

Event data indicated that the autothrottle was a significant factor in the CR in 7 of 81 events 

(8%): 3 LOC, 1 Other, and 3 SDGE events. The three LOC events were 2 HF and 1 S events. 

The Other and SDGE events were all incidental events. In 62 of 81 events (77%), it could be 

reliably determined or inferred that the autothrottle was not a significant factor in the CR. In 12 

of 81 events, significance could not be determined. 

• LOC: Autopilot and autothrottle were both engaged in one Stuck Throttle LOC event 

and in an Engine Powerloss/Subidle LOC event. In the Stuck Throttle event, the throttle 

stuck at idle, the autothrottle created the thrust asymmetry, and the autopilot masked the 

thrust asymmetry. In the Powerloss/Subidle event, both the autothrottle and autopilot 

masked the thrust asymmetry. The autothrottle alone was engaged in one LOC. 

• Other: Autopilot and autothrottle were engaged together and were known contributing 

factors in one Other event—a cruise engine subidle Incidental event involving loss of 

thrust on an engine and the consequent loss of airspeed from 250 to 180 knots. After an 

autothrottle power reduction, the engine had failed to respond to the autothrottle powerup command. Both the autothrottle and autopilot masked the thrust asymmetry. The 

crew successfully intervened when the autopilot, unable to hold altitude and track, finally 

disconnected. 

• SDGE: There were three SDGE events where autothrottle only was engaged (i.e., 

autopilot not engaged). These were all Stuck Throttle events where the crew

misinterpreted the low/idle power engine as failed and shut it down. One of these events 

was in Climb, and two were on Approach. All involved two-engine aircraft. 

Analysis of AIA report event data for autopilot and autothrottle use indicates potential ICR 

prevention and risk mitigation will benefit in annunciating PSMs that are masked or obscured by 

autopilot or autothrottle engagement. Specifically, throttle splits, engine fail low and fixed, and 

possibly thrust asymmetry. 

4-19
4.1.5.3.9 Engine Indications and PSM Annunciations—Significance in ICR. 

Engine indications were available in most events. Indications and annunciations were a 

significant factor in the CR in 21% of events (17 of 81). They were not significant in 20% of 

events (16 of 81). Significance could not be determined in 59% of events (48 of 81) due to the 

lack of specific reference or inference to engine indications or annunciations. 

RTO>V1 accounted for 8 of the 17 events (47%) where indications and annunciations were a 

significant factor in the CR. As previously noted in the characterization of RTO>V1, 27% of the 

RTO>V1 events (8 of 30) were initiated on the basis of an indication light, annunciation/alert, or 

crew callout. 

Analysis of PSM+ICR event data suggested that the presence of indications and annunciations is 

a contributing factor in RTO>V1 events. Conversely, event data suggested that the lack of PSMrelated engine indications and annunciations is, or may be, a contributing factor in the other ICR 

categories where UCR to PSMs occur, particularly in SDGE on two-engine aircraft and LOC 

events. 

4.1.5.3.10 Overall Summary Cues: Aural, Tactile, and Other Indications. 

Aural bangs and booms and tactile airplane vibration and shudder that exceed crew experience 

and expectations often accompany surge events—even recoverable ones. The event data did not 

indicate or suggest that, to any significant degree, crews are misinterpreting PSMs such as Surge 

as some other problem (e.g., bomb, tire, etc.). However, anecdotal evidence and reports 

indicated that misinterpretation/misdirection is more prevalent than the data indicated. There 

were three reported events, all RTOs, where such explicit misinterpretation occurred: two 

thought the Surge effects were main landing gear tires, and one thought the Surge effects was a 

bomb. 

It can often be inferred from the data that, in general, crews know they have a PSM but believe it 

has resulted from or may have caused severe engine damage. There are many contributing 

factors in the crew decision to shutdown an engine, not all are safety-related. It is plausible, in 

the absence of any explicit indications to the contrary, that crews may be convinced that a 

violent/ high-power surge has caused severe engine damage, and may then elect to shutdown the 

affected engine as a precaution. This is particularly likely, and undesirable, in the case of a 

violent but recoverable engine surge. Commercial transport aircraft are designed to safely fly 

with an In-Flight Engine Shutdown. However, unnecessary IFSD is undesirable, particularly on 

a two-engine aircraft, where it reduces available thrust and propulsion redundancy. Unnecessary 

IFSD is undesirable, but not unsafe. 

Powerloss events are generally within the crew’s experience and expectation. Powerloss events 

are accompanied by airplane-level effects, such as thrust asymmetry, that manifest to the crew as 

attitude (yaw, roll, pitch) and airspeed effects. The primary concern with powerloss is 

automation (autopilot and autothrottle) masking of significant thrust asymmetry or slow/late 

recognition of a PSM. Lack of PSM awareness combined with a belief that thrust from both 

engines is available, may result in a complacent or distracted crew losing aircraft state awareness 

4-20
and consequently LOC if the crew does not maintain aircraft single-engine or other operating 

speeds. 

Analysis of aural, tactile, and other indications data suggested that an explicit PSM annunciation 

that identifies the malfunction and guides the crew to an appropriate nonnormal checklist 

procedure may be of potential ICR prevention and risk mitigation value, particularly in the case 

of recoverable Surge events. 

4.1.5.3.11 Crew Error Classification. 

Table 4-14 shows that 67% of the HF events in the AIA report involved knowledge-based errors. 

Knowledge-based errors occur in situations where the crew is faced with novel and unfamiliar 

situations. The problem solving required in these unfamiliar situations is goal-driven and based 

on an analysis of the environment and the overall aims of the person. Errors arise from selecting 

the wrong goal, incomplete or inaccurate knowledge, and human limitations in terms of 

information processing. Specifically, the more complex the problem, the more data that must be 

integrated, and the less time available alone and in combination to process the information; all of

which increase error potential. 

Fifty-eight percent of the HF events in the AIA report involved skill-based errors. Skill-based 

errors occur in situations where the crew executes a very familiar task without consciously 

thinking about how it is executed. Skill-based errors result from doing the right thing 

incorrectly, or intending to do something but because of distraction or memory failure, not 

completing the action. 

Twenty-five percent of the HF events in the AIA report involved rule-based errors. Rule-based 

errors occur in situations where the crew is consciously following a rule or procedure from

memory or checklist. Rule-based errors typically involve misclassification of situations leading 

to the application of the wrong rule or the incorrect recall of procedures. Rule-based errors 

result from either not doing something that should be done or result from doing the wrong thing. 

TABLE 4-14. CREW ERROR CLASSIFICATION VERSUS HF EVENTS 

Error Classification Skill Rule Knowledge 

HF Events (12) 58% (7 of 12) 25% (3 of 12) 67% (8 of 12) 

There was insufficient time in task 2.1 to complete a comprehensive analysis of the Crew Error 

classification versus HF events. Such analysis would likely provide additional insight into 

effective error prevention strategies and designs. 

4-21
The Crew Error classification versus HF events data indicated that the following are of potential 

benefit in ICR prevention/reduction: 

• Providing crew awareness that a PSM exists 

• Providing and linking to explicit procedures for the PSM 

• Reducing the crew integration/interpretation tasks 

• Increasing the time available to the crew 

• Facilitating the crew response 

Specifically, an explicit PSM annunciation that identifies the affected engine and guides the crew 

to an appropriate nonnormal checklist has potential to prevent/reduce ICR and mitigate the risk 

of crew error. 

4.1.5.4 General and Specific PSM+ICR Safety Concerns From Event Analyses. 

4.1.5.4.1 General Safety Concerns. 

General PSM+CR-related safety concerns are as follows: 

• Those PSMs that create or have potential to create significant thrust asymmetries—These 

are primarily PSMs that cause engine failure at high, low, and fixed power settings. Both 

powerloss and surge are engine fail low symptoms. Stuck throttle is an engine failed 

fixed. There was only one engine fail high event (runaway) in the AIA event database. 

This occurred on landing at thrust reverser deployment, which prevented deployment of 

the affected engine thrust reverser. There were three Stuck Throttle-related overthrust 

events, all on two-engine aircraft with autothrottle engaged. In the most notable event, a 

B737 on approach at 700 feet, a throttle stuck at medium power. To control speed, the 

autothrottle reduced the engine it could still control to idle. The crew, believing the 

engine at idle had flamed out, shutdown that engine and landed, thus operating the engine 

with the stuck throttle. 

• SDGE on a two- or four-engine aircraft when one of the engines is malfunctioning—This 

significantly reduces available engine power and in the worst-case, results in an 

unpowered aircraft. Even when both engines are functioning normally, it reduces 

available engine power by 50% and unnecessarily increases the risk of unpowered flight. 

There were three such instances in the AIA report event database, all involving stuck 

throttles. Note that regardless of where the throttle was stuck (low or high), invariably, 

the crew shutdown the engine at the lowest or idle power. 

• SDGE on a four-engine aircraft on the same side as a malfunctioning engine—This 

creates both the significant thrust asymmetry usually associated with LOC events, and 

the reduced power increased the risk concerns listed above. 

• The presence or lack of PSM-related engine indications and annunciations appear to be 

contributing factors in UCRs to PSMs—Many events indicate that the presence or lack of 

PSM-related engine indications and annunciations is a contributing factor in UCR to a 

4-22
PSM. In many cases, it appears that the crew does not initially know a PSM exists until 

the malfunction reveals itself at high power, through low airspeed, through unusual 

attitude, or some combination of the three. In other cases, the crew may know a PSM 

exists, but cannot determine, due to lack of information or time, the specific nature of the 

malfunction, which engine is malfunctioning, or the extent of the malfunction. Only a 

few events explicitly indicate or suggest that crews are misinterpreting PSM as some

other event (e.g., bomb). However, anecdotal information indicates that 

misinterpretation and misdirection may often play a significant contributing role in UCR. 

4.1.5.4.2 Specific CR Category Safety Concerns. 

Specific concerns associated with each CR category are documented in the following 

paragraphs. In general, a consistent contributing factor is lack of crew awareness of the 

existence or location of a PSM, i.e., the absence of an explicit indication or annunciation that a 

PSM exists and which identifies the affected engine(s). 

4.1.5.4.2.1 Loss of Control. 

The principal concern associated with LOC is a PSM that results in significant thrust asymmetry 

combined with loss of airspeed and/or attitude control. The PSMs associated with HF LOC 

events are Powerloss and Stuck Throttle at low altitude in Climb, Descent, and Approach/Go 

Around phases of flight. In general, by the time the crew detects Thrust Asymmetry and 

attributes it to a PSM, the ICR has either occurred or is unavoidable, i.e., it is generally too late 

to prevent the ICR or significantly mitigate the situational risk. 

4.1.5.4.2.2 Other Events. 

The principal concern associated with Other events is PSM, where the crew fails to follow

established procedure, e.g., engine shutdown/secure or RTO<V1. The cause of these CR is not 

clear, but it is suspected that the lack of PSM information may have played a role. The PSMs 

associated with HF Other events are Engine Fire, Powerloss, and Surge at low altitude in 

Takeoff Climb phase of flight. 

4.1.5.4.2.3 Shutdown/Throttled Good Engine. 

The principal safety concern associated with SDGE is shutting down the good engine on a twoengine aircraft. In general, when engine shutdown is intentional, this ICR can be attributed to 

the lack of knowing which specific engine is affected. 

The one catastrophic HF event in this category occurred on a two-engine aircraft and involved a 

nonrecoverable engine surge that initiated at FL290. The crew reduced power to idle, then 

shutdown the good engine 2 minutes later. The malfunctioning engine failed on approach, and 

the crew was unable to restart the good engine before crashing short of the runway. 

4-23
There are three other similar, but incidental, events in the SDGE category. 

1. Event no. 42 (ID # 85/MWB/2/I). A B767-200 experienced engine stall/surge at FL390 

with airframe buffet. The crew idled then shutdown the left engine and diverted. The 

left engine was restarted during driftdown (at or below FL290?). After landing, a 

borescope examination found nothing wrong with the left engine, but found a 13th and 

14th stage high-pressure compressor damage on the right engine. It is unknown what 

would have happened had the crew not restarted the good engine and stressed the 

damaged engine on a single-engine approach. 

2. Event no. 66 (ID #*93/MNB/2/I) illustrates an observed crew’s tendency to unwittingly 

but inappropriately indict low-power versus high-power engine states. When presented 

with two engines operating at different power levels, e.g., one operating normally at low 

power and one failed at a higher-power state, event data indicate that crews often assume

the low-power engine has failed subidle or flamed out. This UCR frequently occurs in 

Stuck Throttle and Engine Control Malfunction events and has been observed in other 

contexts. The no. 1 engine throttle on a B737-400 on final approach at 700 feet 

apparently stuck. To maintain approach speed, the autothrottle reduced the no. 2 engine 

throttle to idle. The crew apparently mistook the no. 2 engine thrust reduction as a 

flameout, shut the engine down, and landed with one engine. 

3. In a post-AIA report event, a B777 on approach experienced a right engine control fault 

that resulted in the right engine failing fixed at intermediate power. To maintain speed, 

the autothrottle reduced the left engine power to idle. In response to the left engine at 

idle and the right engine failed fixed at higher power, the crew shutdown the left engine. 

Notes: These three incidental events where the crew shutdown the good engine on a two-engine 

aircraft differ from the HF event of primary concern in that the PSM-affected engine was 

recoverable or remained useable, and in two of three instances, the crew was able to 

restart the good engine before landing. 

Although autothrottle was a significant contributing factor in two of the events described 

above, the AIA report contains two similar Engine Shutdown events (no. 41 (ID 

#85/EWB/4/I-2) and no. 71 (ID #94/MWB/4/I) where the autothrottle was not engaged 

and crew throttle reduction and consequent engine indication changes were similarly 

misinterpreted. There are also events in other categories where the autothrottle was not 

engaged and falling engine indications were significant factors in the UCR that occurred. 

A secondary concern associated with SDGE is, in general, shutting down any 

nonmalfunctioning good engine on a four-engine aircraft with a malfunctioning engine. 

Of more specific concern on four-engine aircraft is the thrust asymmetry associated with 

shutting down the nonmalfunctioning good engine on the same side as the 

malfunctioning engine. 

4-24
4.1.5.4.2.4 RTO>V1. 

The principal safety concern associated with RTO>V1 is RTO after liftoff. In general, this 

occurs because the crew believes the aircraft is not airworthy or capable of safe flight. In the 

AIA event data, there were no fatalities associated with RTOs that initiated on the ground. The 

general concern relates to the potential for runway excursion/overrun into irregular terrain, gear 

collapse, and striking an obstacle or obstruction causing cabin damage and fire. 

4.1.6 Review and Analysis of Post-AIA Report PSM, IFSD, and PSM+ICR Data. 

4.1.6.1 Propulsion System Malfunction Data. 

The PSM data used in this report is limited to Boeing aircraft currently in production. How 

accurately the data represents the worldwide fleet PSM rate is uncertain. Follow-on research is 

proposed to validate the PSM data and related calculations in this section. 

Reportable events and issues fall into one of several categories: General, Airplane Handling 

Characteristics and Performance, Structures, Occupant Safety, Mechanical Systems, Electrical 

Systems, and Propulsion Systems. Some events and issues repeat or clarify requirements that 

exist in Title 14 Code of Federal Regulations 21.3. Within the various categories, the following 

are among reportable events: 

• Incorrect, misleading, or confusing Flight Deck indications that could have hazardous 

effects. 

• Conditions resulting in serious injury to operator personnel or passengers. 

• Any event where multiple systems have been involved that were intended to be 

independent and isolated. 

• Uncontained high-energy rotor failures. 

• Environmental, operational, or (common cause) failure conditions that adversely affected 

more than one engine, or that adversely affected one engine and could have adversely 

affected more than one engine. (Bird Strike events need not be reported under this item.) 

• Failures or conditions that resulted in or could have resulted in an ignition source in a 

fuel tank. 

• Engine separation, loss of thrust, loss of thrust control, uncommanded thrust change, 

engine flameout, or engine shutdown (other than normal shutdowns at the end of an 

operation). 

• Failures or conditions that may significantly reduce propulsion system reliability or that 

may otherwise affect the safety of extended range missions. 

4-25
PSM reports originate as Field Service telex messages. These telexes are processed and posted 

on a web-based bulletin board for 90 days, and then archived on a quarterly basis. On-site or 

regional field service representatives cover approximately 95% of Boeing’s customers, thus 

covering most of the Boeing in-service fleet. The PSM database contains data for all Boeing 

aircraft—in-production and postproduction. 

4.1.6.1.1 2000 and 2001 Propulsion System Malfunctions. 

Table 4-15 and figure 4-3 document reportable 2000 and 2001 Propulsion System Malfunctions. 

Table 4-15 contains the number of occurrences, the percent of total occurrences, and a calculated 

rate of occurrence for each malfunction. Figure 4-3 illustrates the number of occurrences of each 

malfunction. 

TABLE 4-15. 2000 AND 2001 PROPULSION SYSTEM MALFUNCTIONS 

PSM 

Number of 

Occurrences 

Percent 

of Total Rate/Flight 

Surge 227 26.2 1.28E-05

Oil System 182 21.0 1.03E-05 

Powerloss 149 17.2 8.42E-06 

High Vibration 63 7.3 3.56E-06 

Light/Message/Indication 32 3.7 1.81E-06

Overheat 29 3.3 1.64E-06

Failed Fixed Thrust 27 3.1 1.53E-06 

Engine Exceedances 26 3.0 1.47E-06 

Bird Strike 24 2.8 1.36E-06 

Engine Parameter Anomaly 23 2.7 1.30E-06 

Fuel System/Fuel Leak 21 2.4 1.19E-06 

Fire Warning (Actual) 18 2.1 1.02E-06 

Inside Smoke/Fumes 14 1.6 7.91E-07 

Fire Warning (False) 13 1.5 7.34E-07 

Thrust Control Problem 5 0.6 2.82E-07 

Other 5 0.6 2.82E-07

Autothrottle Anomaly 4 0.5 2.26E-07 

Miscellaneous Fire System 3 0.3 1.69E-07 

Fail High Thrust 2 0.2 1.13E-07 

Total 867 100.0 4.90E-05

4-26
0

50

100

150

200

250

Surge

Oil System

Powerloss

High Vibration

Light/Message/Indication

Overheat

Fail Fixed Thrust

Eng Exceedences

Birdstrike

Eng Parameter Anomaly

Fuel System/Fuel Leak

Fire/Fire Warning

(Actual)

Inside Smoke/Fumes

Fire Warning (False)

Thrust Control Problem

Other

AutoThrottle Anomaly

Misc Fire Sys

Fail High Thrust

N

umber of 

O

c

c

urrences 

FIGURE 4-3. 2000 AND 2001 PROPULSION SYSTEM MALFUNCTIONS 

To enable comparison of PSM and AIA report event data, PSM data was filtered to remove 

Preflight, Taxi, and Postflight malfunctions. In addition, certain PSMs were grouped into larger 

more general categories such as Powerloss. 

Table 4-15 documents the overall likelihood of a PSM in the flight phases, where the occurrence 

of UCR is a safety concern, is on the order of 1 in every 20,000 flights. Table 4-15 documents 

and figure 4-3 illustrates the PSMs most likely to occur are Surge, Oil System, Powerloss, or 

High Vibration. Surge, Powerloss, and High Vibration are associated with such ICRs as 

RTO>V1, LOC, and SDGE. Notably, Oil System malfunctions are not significantly associated 

with ICR, even though 88% of the Oil System malfunctions result in IFSD. 

4.1.6.1.2 Surge Recoverability and IFSD Analysis. 

Table 4-16 and figure 4-4 document PSM Surge event data. Not all in-service Surge events on 

in-production Boeing aircraft are documented in the PSM data shown. Many minor Surge events 

occur without, and do not require, crew awareness. A meaningful surge is defined as a surge 

sufficient to get or require crew awareness or action. The Surge events in the PSM data were of 

sufficient magnitude and duration to get crew awareness and are, therefore, considered 

meaningful. The table and figure show that the percentages of recoverable (44.1%) and 

nonrecoverable (43.2%) surges documented in the PSM data are about equal. Approximately 

43% of all surges listed are nonrecoverable. These nonrecoverable surges generally result in 

IFSD of the affected engine. Approximately 44% of all surges listed are recoverable. 

Observations regarding Surge events: 

• Approximately 14% of all surges self-recovered without crew action. Surges that selfrecovered without crew action generally involve no IFSD. 

4-27
• Most, about 80%, of the recoverable surges (24% of all surges listed) that involve crew 

action to recover do not involve IFSD. 

• About 20% of recoverable surges (6% of all surges listed) that involve crew action to 

recover also involve IFSD. 

• About half of all Surge events (49.4%) involve IFSD of the affected engine. The 

potential to reduce the overall number of IFSDs associated with Surge events is limited to 

the 6% of overall Surge events involving both recoverable surge and IFSD. 

TABLE 4-16. SURGE RECOVERABILITY AND IFSD ANALYSIS 

Surge Type (R vs NR) Number of Occurrences Percent of Total 

Nonrecoverable 98 43.2

Recoverable—Crew Action 69 30.4 

Recoverable—No Crew Action 31 13.7 

Recoverability Unknown 29 12.8 

Total 227

 Recoverable—Crew Action: No IFSD 55 79.7 

 Recoverable—Crew Action: IFSD 14 20.3 

0

20

40

60

80

100

120

Nonrecoverable

Recoverable - Cre

w Action

Recoverable - No Crew Action

Recoverability Unkown

Recoverable - Cre

w Action:

No IFSD

Recoverable - Cre

w Action:

Com

manded IFS

Nu

D

mber of Occurrences

2000 and 2001 Continued Operational Safety Program Data

FIGURE 4-4. SURGE RECOVERABILITY AND IFSD ANALYSIS 

4.1.6.1.3 Engine Powerloss/Failure Analysis. 

Table 4-17 and figure 4-5 document Powerloss and Engine Failure event data. Most Engine 

Failure events result in powerloss. The table and figure show a breakdown of the events that 

have been generalized as Powerloss. 

4-28
Most Powerloss events are engine flameouts (44.3%). Partial powerloss, powerloss to low

thrust, and thrust shortfall account for 37.2% of Powerloss events. About 15% of Powerloss 

events involve failures at some fixed intermediate power level. Failed Fixed Thrust events have 

the potential to become either Overthrust or Underthrust conditions. Only about 1% of 

powerloss/engine failure events involve failure to a high-thrust condition. 

TABLE 4-17. ENGINE POWERLOSS/FAILURE ANALYSIS 

PSM Number of Occurrences Percent of Total 

Flameout 81 44.3

Powerloss/Fail Low Thrust 38 20,8 

Thrust Shortfall 30 16.4 

Fail at Fixed Thrust 27 14.8 

Fail High Thrust/Overspeed 2 1.1 

Total 178

2000 and 2001 Continued Operational Safety Program Data

0

10

20

30

40

50

60

70

80

90

Flameout

Powerloss/Fail

Low Thrust

Thrust Shortfall

Fail at Fixed

Thrust

Fail High

Thrust/Overspeed

Propulsion System Malfunction

Number of Occurrences

FIGURE 4-5. ENGINE POWERLOSS/FAILURE ANALYSIS 

4.1.6.1.4 In-Flight Shutdown Analysis. 

Table 4-18 and figure 4-6 document 736 PSM events and the number of IFSDs associated with 

each PSM type. 

In-Flight Shutdown is defined as a cessation of engine combustion. IFSD may be crew 

commanded (e.g., via the fuel cutoff switch or fire handle) or may result directly from the PSM 

(e.g., flameout). Within the crew-commanded IFSD category, there are PSMs where the crew, 

by procedure, must shutdown the engine, e.g., Fire Warning. There are other PSMs where more 

crew discretion exists regarding IFSD, e.g., Oil System, Powerloss, Surge, and Vibration. 

4-29
TABLE 4-18. 2000 AND 2001 IFSD ANALYSIS 

PSM 

Number of 

Events IFSD No IFSD Unknown

Oil System 182 157 21 4 

Nonrecoverable Surge 96 96 0 0 

Powerloss/Thrust Control 90 32 5 53 

Flameout 81 81 0 0

Recoverable Surge 69 14 55 0 

Engine Vibration 63 47 14 2 

Self-Recoverable Surge 31 0 31 0 

Overheat Warning 29 7 22 0 

Fire Warning 26 26 0 0 

EGT Indication 17 6 10 1 

Bird Strike 16 5 11 0 

Fuel Leak 9 1 7 1 

Start System 13 7 6 0 

Bleed System 11 0 9 2 

Thrust Reverser 3 1 2 0 

Totals 736 480 193 63

0

50

100

150

200

Oil System

Nonrecoverable Surge

Powerloss/Thrust Control

Flameout

Recoverable Surge

Engine Vibration

Self-Recoverable Surge

Overheat Warning

Fire Warning - IFSD

EGT Indication

Birdstrike

Fuel Leak

Start System

Bleed Syste

m

Thrust Reverser

Propulsion System Malfunctions

Number of Occurrence

s

No. Events

IFSD

No IFSD

Unknown 

FIGURE 4-6. 2000 AND 2001 IFSD ANALYSIS 

4-30
Not all the PSMs listed in table 4-15 were analyzed for IFSD. On-ground events were not 

included in table 4-18 and figure 4-6, e.g., eight RTOs were not included in Bird Strike and two 

landing roll reverse thrust events were not included in Nonrecoverable Surge. In addition, 

Flameout, which was included in table 4-15 as a powerloss, is treated separately in table 4-18 to 

differentiate non-crew-commanded from crew-commanded IFSD events. 

Observations: 

• Of the 736 PSM events (table 4-18): 

− 65% of the PSM events involved an IFSD—most were crew-commanded 

− 26% of the PSM events did not result in an IFSD 

− IFSD could not be determined in 9% of the PSM events 

• Of the 480 (65%) PSM events that involved IFSD (table 4-18): 

− 33% of IFSDs (157 of 480) were Oil System-related 

− 56% of IFSDs (270 of 480) were Surge, Flameout, Vibration, or Powerlossrelated 

− All Nonrecoverable Surge events involved IFSD 

− All Flameout events involved IFSD 

− Most High Vibration events involved IFSD 

− Where it can be determined, most Powerloss events involved IFSD. However, 

IFSD cannot be determined in more than half the Powerloss events. 

• Of the 193 (26%) PSM events that involved IFSD (table 4-18): 

− None of the Self-Recoverable Surge events involved IFSD 

− Most Recoverable Surge, Bird Strike, and Fuel Leak events did not involve IFSD 

The majority of In-Flight Shutdown events involved malfunctions associated with UCR, 

specifically Surge, Vibration, or Powerloss/Flameout. 

4.1.6.1.5 Engine Restart Analysis. 

IFSD events are derived from the PSM data. Part of the IFSD data includes a restart analyses 

based on PSM event and other data. Table 4-19 and figure 4-7 document and illustrate the total 

number of Boeing IFSDs reported from 1995 through 2001. The table and chart also document 

and illustrate 

4-31
• The number of in-flight restart attempts and the number of successful in-flight restart 

attempts. 

• Where no restart attempt was reported, a restart analysis based on event and postevent 

data that classifies each as restartable, nonrestartable, or unable to determine. 

TABLE 4-19. 1995-2001 IFSD RESTART ANALYSIS 

1995-2001

Total IFSDS 1602 

Restarts Attempted 140 (9%) 

 Successful Restart Attempts (63%) 88 (6%) 

 Unsuccessful Restart Attempts (37%) 52 (3%) 

No Restart Attempt Reported 1462 (91%) 

 Analysis: Restartable (11%) 157 (10%) 

 Analysis: Nonrestartable (87%) 1268 (79%) 

 Analysis: Unable to Determine (2%) 37 (2%) 

0

50

100

150

200

250

300

Total

IFSDS

Restarts

Attempted

Successful

Restart

Attempts

No Restart

Attempt

Reported

Analysis:

Restartable 

Analysis:

NonRestartable 

Analysis:

Unable to

Determine

Number of E

vent

s

1995

1996

1997

1998

1999

2000

2001

FIGURE 4-7. 1995-2001 IFSD RESTART ANALYSIS 

In approximately 9% of the 1602 IFSD events listed, in-flight restart was attempted (140/1602). 

Sixty-three percent (88/140) of these in-flight restart attempts were successful (5.5% of the 1602 

IFSDs). 

4-32
In the 91% of the 1602 IFSDs where no restart attempt was reported (1472 events), by analysis 

• 87% (1268/1472) were nonrestartable (79% of the 1602 IFSDs), 

• 11% (157/1462) were restartable (10% of the 1602 IFSDs), and 

• 2% (37/1452) were unable to determine (2% of the 1602 IFSDs). 

Most (82%) IFSD events listed are not restartable (1320 of 1602). Only 15% of IFSDs are 

restartable (245 of 1602). Ninety-one percent of IFSD events did not involve a reported restart 

attempt. Nine percent of IFSD events involved a reported in-flight restart attempt—more than 

half (63%) of the restart attempts were successful. 

As previously noted, the majority of IFSD events involved malfunctions associated with UCR. 

The IFSD restart data and analysis indicated that such malfunctions are typically nonrecoverable. 

4.1.6.2 Post-AIA Report PSM+ICR Events on Boeing Aircraft. 

The PSM and IFSD data reviews combined with anecdotal knowledge and ad hoc processes 

were used to identify 10 post-AIA Report PSM+ICR events in the period between 1996 and 

2001: 2 H, 1 S, and 7 I. Three of these events, all incidents, were fuel leak- or fuel imbalancerelated. These fuel events are listed separately below, and they are excluded from post-AIA 

report PSM+ICR rate calculations to allow comparison with the AIA report rates that also 

excluded such fuel-related events. Because the databases and processes used were Boeingrelated, the results contain only Boeing aircraft. Similar post-AIA report PSM+ICR events are 

known to occur on other manufacturer’s aircraft but are not documented here. 

The remaining seven post-AIA report events involved two Other, two LOC, two SDGE, and one 

RTO>V1. 

The following seven examples of in-service PSM+ICR events are arranged in chronological 

order of occurrence. 

• An Other category RTO runway overrun involving loss of engine power during takeoff 

and resulting in aircraft hull loss (1996 H events). 

• An Other category RTO runway excursion involving low-engine EPR indication and 

causing substantial aircraft engine damage (1997 S events). 

• An LOC runway excursion during RTO involving an engine failed high (1997 H event). 

• A SDGE during descent involving an overthrust condition where actual thrust failed to 

above-commanded thrust on one engine. The good/unaffected engine fuel control switch 

was selected off then on (1997 I event). 

• An LOC shortly after takeoff involving compressor stall/surge, misidentification of the 

initial malfunction, and then failure to maintain directional and airspeed control. The 

initial malfunction was misidentified as gear/tire-related (1998 I event). 

4-33
• A SDGE during a descent from FL410 involving an engine failed low. The crew was 

attempting to restart the left engine during this descent. Autothrottle reduction of power 

on the right engine was misinterpreted as a right engine flameout. About 8 seconds after 

the first attempt to restart the left engine, a rapid relight of the right engine was initiated 

(2000 I event). 

• A RTO>V1 involving bird strike and associated high EGT. Takeoff was rejected at 149 

knots, and the airplane came to a stop near the end of the runway with seven of the eight 

tires destroyed (2000 I event). 

The following three events, all fuel leak- or fuel imbalance-related incidents, are excluded from

post-AIA report PSM+ICR rate calculations to support comparison with the AIA report rates that 

also excluded such fuel-related events. Note, however, that these UCR fuel events exhibit the 

same underlying contributing factors of inadequate crew awareness, incorrect understanding, and 

incorrect response. 

• A SDGE during descent due to suspected fuel leak. Visual Fluid indications near the 

engine turned out to be deicing fluid (2000 I event). 

• An Other category fuel leak event involving failure to shutdown engine. The engine 

experiencing a significant fuel leak was not shutdown (2001 I event). 

• An Other category fuel imbalance event involving inadvertent dual-engine shutdown 

during climbout. Flameout of both engines on a two-engine aircraft was inadvertently 

induced. Engine flameout was due to crew-induced suction feed combined with 

unweathered fuel (2001 I event). 

Accident and incident event data indicate that UCR to PSM continues to occur in-service. But, 

as previously noted, there is no formal process that identifies and documents ICR in general, or 

PSM-related ICR in particular. These investigators estimate that 

• most ICR-related events involving fatalities or hull loss are identified and documented in 

FAA and Boeing databases by the rigorous accident reporting and investigation protocols 

involved. 

• approximately 75% of the ICR events involving substantial damage are identified and 

documented in FAA and/or Boeing databases by the reporting protocols involved. 

• less than 50% of the incidental ICR events that occur in-service are identified and 

documented in FAA and/or Boeing databases and explicitly identified as inappropriate or 

UCR. 

Based on these estimates, and the process by which the events listed below were gathered, it is 

certain that these 11 events do not accurately quantify post-AIA report PSM+ICR nor do they 

fully quantify and characterize UCR to malfunctions or conditions in other nonpropulsion 

airplane system areas. 

4-34
4.1.6.3 The AIA Report PSM+ICR and 2000-2001 PSM Data Comparison/Analysis. 

4.1.6.3.1 The AIA Report PSM+ICR and 2000-2001 PSM Data Comparison. 

Table 4-20 and figure 4-8 document a comparison of AIA report PSM+ICR and 2000-2001 PSM 

data. Most major PSM occurrences correlate to AIA report PSM+ICR occurrences. The notable 

exception is Oil System malfunctions, which seldom involve, or are associated with, ICR. Note 

that the only AIA report Oil System-related PSM+ICR involved an air turn back that resulted in 

a rushed approach and long landing. Therefore, the single correlation between Oil System PSM 

and ICR is highly questionable. The Task 1.2 Operational Assessment will investigate the 

correlation between PSM and ICR correlations, or lack thereof. 

TABLE 4-20. RELATIVE RANKING OF AIA PSM+ICR AND 2000-2001 

PSM EVENT DATA 

Primary PSM/Symptom

PSM+ICR 

Number of 

Occurrences 

PSM+ICR 

Percent of 

Occurrences 

2000-2001 

PSM Number 

of Occurrences 

2000-2001 

PSM Percent of 

Occurrences 

Surge 37 45.7 227 26.2

Oil System 1 1.2 182 21.0 

Powerloss 25 30.9 149 17.2 

High Vibration 4* 4.9 63 7.3

Light/Message/Indication 6 7.4 32 3.7

Overheat 29 3.3

Failed Fixed Thrust 6 7.4 27 3.1 

Engine Exceedances 26 3.0

Bird Strike 24 2.8

Engine Parameter Anomaly 23 2.7 

Fuel System/Fuel Leak 21 2.4 

Fire/Fire Warning (Actual) 18 2.1 

Inside Smoke/Fumes 14 1.6

Fire Warning (False) 13 1.5 

Thrust Control Problem 5 0.6 

Other 2 2.5 5 0.6

Autothrottle Anomaly 4 0.5

Miscellaneous Fire System 3 0.3 

Fail High Thrust 2 0.2 

TOTALS 81 867

* From table 4-3, vibration was considered a primary PSM or symptom in events 32, 42, 55, and 57. However, 

vibration is known to be present in at least ten PSM+ICR events (32, 42, 46, 53, 55, 68, 73, 76, and 77). 

4-35
0.0%

10.0%

20.0%

30.0%

40.0%

50.0%

Sur

g

e

Oil Sy

stem

Pow

erlo

s

s

High Vibration

Lig

ht/M

e

s

s

age/I

n

O

ver

heat

Fail Fixed 

T

hrust

E

ngine

Birdstrike

Eng P

ara

m

eter

Fuel

Fire/Fir

e War

nin

g

Inside

Fire Warnin

g

Thrust C

o

ntrol

Other

A

utothrottle

Mis

c Fire Sy

s

Fail High Thrust

Propulsion System Malfunction

% of O

ccurrence 

AIA 

PSM

FIGURE 4-8. THE AIA REPORT PSM+ICR VERSUS 2000-2001 PSM EVENT DATA 

4.1.6.3.2 AIA Report PSM+ICR and 2000-2001 PSM Data Analysis. 

AIA PSM+ICR report and 2000-2001 PSM data were combined with fleet flight statistics to 

calculate various frequencies of occurrence and conditional probabilities of ICR and PSM. AIA

PSM+ICR event data spanned 1968 through 1996. Conditional probability is defined as the 

probability of an UCR given a PSM. Per Western turbojet fleet statistics, the 308 million flights 

from 1958 through 1996 were used for the AIA PSM+ICR frequency calculations. The 17.7 

million flights in 2000 and 2001 together with 2000 and 2001 PSM data were used for the PSM 

frequency calculations. 

Table 4-21 documents the frequency all AIA report PSM+ICR event types (HF, H, S, and I), the 

frequency of 2000-2001 PSM events, and the current conditional probability of an ICR event in 

terms of PSM events. 

Table 4-22 documents the frequency of Hull Loss type AIA report PSM+ICR events (HF and H), 

the frequency of 2000-2001 PSM events, and the conditional probability of a Hull Loss ICR 

event in terms of overall PSM events. Based on the investigation and reporting protocols 

associated with Hull Loss events, the values in table 4-22 are considered reasonably accurate 

estimates. 

4-36
TABLE 4-21. THE PSM AND PSM+ICR FREQUENCY AND PROBABILITY OF HF, 

H, S, OR I EVENT 

Primary PSM/Symptom

AIA PSM+ICR 

Frequency Per 

Flight 

2000-2001 PSM 

Frequency Per 

Flight 

Conditional 

Probability of

ICR/PSM 

Miscellaneous 6.5E-09 2.8E-07 1:44

Failed Fixed Thrust 2.0E-08 1.5E-06 1:79 

Light/Message/Indication 2.0E-08 1.8E-06 1:93

Powerloss 8.1E-08 8.4E-06 1:104

Surge 1.2E-07 1.3E-05 1:106

High Vibration3 1.3E-08 3.6E-06 1:274

Subtotal1 2.6E-07 2.84E-05 1:109 

Total (All PSMs)2 2.6E-07 5.0E-05 1:190

1. Subtotal based only on the PSM events listed in table 4-21. 

2. Total based on the 81 AIA report PSM events listed in table 4-21 and the 867 PSM events listed in

tables 4-15 and 4-20. 

3. Vibration was considered a primary PSM or symptom in four events (32, 42, 55, and 57). However, 

vibration is known to be present in at least ten PSM+ICR events (32, 42, 46, 53, 55, 57, 68, 73, 76, and 

77). 

TABLE 4-22. THE PSM AND PSM+ICR FREQUENCY AND CONDITIONAL 

PROBABILITY OF HF OR H EVENT 

Primary PSM/Symptom

AIA PSM+ICR 

Frequency 

2000-2001 PSM 

Frequency 

Conditional 

Probability of

ICR/PSM 

Miscellaneous 3.3E-09 2.8E-07 1:87

Failed Fixed Thrust 6.5E-09 1.5E-06 1:236 

Powerloss 3.3E-08 8.4E-06 1:259

Surge 2.6E-08 1.3E-05 1:493

Light/Message/Indication 3.3E-09 1.8E-06 1:559

High Vibration3 No H or HF events 3.6E-06 

Subtotal1 7.5E-08 2.84E-05 1:379 

Total (All PSMs)2 7.5E-08 5.0E-05 1:671

1. Subtotal based only on the PSM events listed in table 4-21. 

2. Total based on the 81 AIA report PSM events listed in table 4-21 and the 867 PSM events listed in

tables 4-15 and 4-20. 

3. Vibration was considered a primary PSM or symptom in four events (32, 42, 55, and 57)—all incidental. 

However, vibration is known to be present in two HF events (53 and 77) and one H event (46). 

4-37
4.1.6.3.3 Observations. 

• The expected frequency of any AIA report PSM+ICR event (HF, H, S, or I) is 2.6E-07 

per flight, or approximately one event in every 3.8 million flights. 

• The expected frequency of an AIA report PSM+ICR Hull Loss event (HF or H) is 7.5E08 per flight, or approximately one event in every 13.3 million flights. 

• The expected frequency of any PSM is 5.0E-05 per flight, or approximately one event in 

every 20,000 flights. 

• The expected frequency of a Surge, Powerloss, High Vibration, Light/Message/ 

Indication, Failed Fixed Thrust, or Miscellaneous PSM is 2.84E-05 per flight, or 

approximately one event in every 35,211 flights. 

• The conditional probability of any AIA report PSM+ICR event (HF, H, S, or I) per 2000-

2001 PSM event is 1:109, or 1 PSM+ICR event in every 109 PSM events. 

• The conditional probability of a AIA report PSM+ICR Hull Loss (HF or H) event per 

2000-2001 PSM event is 1:379, or 1 PSM+ICR event in every 379 PSM events. 

Failed Fixed Thrust, Powerloss, and Surge are among the most likely ICR-related PSM events to 

occur with Hull Loss. 

Oil System PSM, although one of the most likely to occur, is one of the least likely to involve 

ICR. 

The expected frequency of any AIA report PSM+ICR event (HF, H, S, or I) per flight is 2.6E-07, 

or approximately one event in every 3.8 million flights. The likelihood of a Surge, Powerloss, 

High Vibration, Light/Message/Indication, Failed Fixed Thrust, or Miscellaneous PSM-related 

UCR is 1 per 109 such PSM events, or as stated, approximately one event in every 3.8 million 

flights. 

The expected frequency of any AIA report PSM+ICR Hull Loss event (HF or H) per flight is 

7.5E-08, or approximately one event in every 13.3 million flights. The likelihood of Hull Loss 

due to Surge, Powerloss, High Vibration, Light/Message/Indication, Failed Fixed Thrust, or 

Miscellaneous PSM-related ICR is 1 per 379 PSM events, or as stated, approximately one event 

in every 13.3 million flights. 

4.1.6.4 Post-AIA Report Data Summary, Calculations, and Comments. 

4.1.6.4.1 General. 

Post-AIA report data show that the same PSMs reported in the AIA event data are still occurring 

and are major contributors to the overall PSM rate. The 2000-2001 PSM data provide an overall 

perspective of the distribution and frequency of PSMs, in general, and of the PSMs associated 

with ICR in particular. The PSM data document PSMs that both are, and are not, associated with 

4-38
ICR. This knowledge supports comparative analyses of the PSMs associated with ICR versus 

those that are not associated with ICR. Such comparative analysis helps validate the current 

understanding of PSM+ICR contributing factors and supports development and assessment of 

strategies for ICR prevention and risk mitigation. 

The 2000-2001 PSM data does not specifically document or identify ICR events. The data 

reports system and component failures, and airplane or airplane system design, manufacturing, 

and operational issues. The data contains ICR events, but only incidentally, and not by design. 

ICR events in the data are not explicitly identified or easily distinguished. Because there is no 

formal process to document or quantify PSM+ICR, discovery is, therefore, primarily through 

anecdotal knowledge and ad hoc processes. 

The list of post-AIA report PSM+ICR events in section 4.1.6.2 shows that all the same types of 

ICR observed in the AIA report data continue to occur in service: LOC, Other, SDGE, and 

RTO>V1. Additionally, in the Other category, the list documents Fuel System Leak and 

Imbalance-related ICR not reported in the AIA report. Specifically, the list includes engines 

leaking fuel not shutdown, good engines not leaking fuel intentionally shutdown for suspected 

fuel leaks, and good engines unintentionally shutdown by fuel system mismanagement during 

balancing. 

The same type PSM+ICR events continue to occur in service: LOC, Other, SDGE, and 

RTO>V1. Ten post-AIA report PSM+ICR events were documented: four Other, two LOC, 

three SDGE, and one RTO>V1. The list contains Fuel System PSM-related ICR not reported or 

included in the AIA report data. 

4.1.6.4.2 Post-AIA Report PSM+ICR Rate Calculations for Boeing Aircraft. 

The following calculations are based on the seven post-AIA report events listed in section 4.2 

(2 H, 1 S, and 4 I), and on 56,384,786 flights for all legacy Boeing aircraft from 1996 to 2001. 

As table 4-23 shows: 

• The expected frequency of any post-AIA report PSM+ICR event (HF, H, S, or I) is 1.2E7 per flight, or approximately one event in every 8.1 million flights. 

• The expected frequency of a post-AIA report PSM+ICR HF or H event is 3.5E-8 per 

flight, or approximately one event in every 28.2 million flights. 

• The expected frequency of a post-AIA report PSM+ICR S or I event is 8.9E-8 per flight, 

or approximately one event in every 11.3 million flights. 

Table 4-23 calculations indicate that the post-AIA report PSM+ICR rate for HF and H events has 

decreased by a factor of about 2.1, and overall decreased by a factor of about 2.2. Note, 

however, that the post-AIA report events are limited to Boeing aircraft. Both the AIA report and 

postreport S and I events are believed to be underreported and do not include fuel imbalanceand fuel leak-related events. 

4-39
TABLE 4-23. THE AIA REPORT VERSUS POST-AIA REPORT PSM+ICR RATES 

Hazard Level AIA Report PSM+ICR Rate Post-AIA Report PSM+ICR Rate 

HF 3.9E-08 per flight (one event in 

every 25.7 million flights) 

No HF Events

H 3.6E-08 per flight (one event in 

every 28 million flights) 

3.5E-8 per flight (one event in 

every 28.2 million flights) 

HF and H 7.5E-08 per flight (one event in 

every 13.3 million flights) 

3.5E-8 per flight (one event in 

every 28.2 million flights) 

S and I 1.9E-07 per flight (one event in 

every 5.3 million flights) 

8.9E-08 per flight (one event in 

every 11.3 million flights) 

HF, H, S, and I 2.6E-07 per flight (one event in 

every 3.8 million flights) 

1.2E-7 per flight (one event in 

every 8.1 million flights) 

4.1.7 Task 2.1 Report Conclusions and Recommendations. 

The greatest potential for ICR prevention or mitigation is in the areas of Powerloss, Surge, and 

Failed Fixed Thrust, which are categorized as primary PSMs or symptoms. There is less 

potential for ICR prevention or mitigation in the area of High Vibration, which is typically 

considered a secondary PSM or symptom, and the potential for ICR prevention or mitigation has 

yet to be determined or demonstrated for Thrust Asymmetry, which is considered an airplanelevel effect, not a PSM. 

4.1.7.1 General. 

The spreadsheet in appendix A contains selected event data from the AIA report event database. 

Additionally, it contains columns that document the event/data review. Specifically, these 

columns document the review assessment of PSM recoverability, and significance of indications, 

annunciations, thrust asymmetry, autopilot, and autothrottle to the crew response. Columns also 

document annunciation prevention potential and malfunction detection potential. This document 

provides traceability back to each event in the database and to the AIA report. The AIA Report 

Volume II contains detailed information and a narrative of each event organized by ICR and 

identified by event number. Appendix A and AIA Report Volume II can be correlated by event 

number. 

In addition, there are two columns that output other tasks: (1) Potential Flight Deck PSM 

Annunciations and (2) Recommended Propulsion Detection/Investigation/Study PSMs. 

• The Potential Flight Deck PSM Annunciations are output to task 1.2 for Operational 

Assessment of usefulness/effectiveness as Flight Deck PSM Indications or alerts. Where 

there are multiple potential annunciations listed for a given event, they are qualitatively 

ordered from most to least likely potential. Some are identified with question marks to 

indicate that their potential to effect positive change in crew response is considered 

questionable. Recommendations are summarized in the following section. 

4-40
• The Recommended Propulsion Detection/Investigation/Study PSMs are output to task 5.1 

for Malfunction Characterization and to task 5.2 for Malfunction Investigation/Study of 

detection potential. The recommendations are qualified wherever possible to identify the 

specific nature of the PSM to aid in selection of PSMs for investigation and study. 

Recommendations are summarized in a following section. 

4.1.7.1.1 Potential Flight Deck Annunciation Recommendations. 

The following are recommended for task 1.2 assessment for usefulness/effectiveness and 

acceptability as potential indications or alerts: 

• Powerloss 

− Engine Failure (flameout or subidle) 

− Thrust Shortfall (commanded thrust greater than actual thrust) 

• Surge 

− Self-Recoverable 

− Recoverable with crew action 

− Nonrecoverable 

• Failed Fixed Thrust 

− Engine Failed Fixed Thrust (no response to throttle/commanded power) 

− Stuck Throttle (throttle split) 

• High Engine Vibration 

• Thrust Asymmetry

4.1.7.1.2 The PSM Characterization and Investigation/Study Recommendations. 

The following recommendations are provided to support the task 2.1 input of safety concerns to 

task 5.1 and task 5.2. The PSMs listed are recommended for task 5.1 and task 5.2 to determine 

malfunction detection potential. 

4.1.7.1.3 The PSM Characterization Recommendations. 

It is recommended that Propulsion (task 5.1) characterize the following engine malfunctions: 

• Recoverable and Nonrecoverable Surge at low (Flight Idle), medium (Cruise), and high 

(Takeoff and Climb) power settings to help determine the potential to detect these 

malfunctions and to help determine the potential to differentiate recoverable and 

nonrecoverable malfunctions at each of these power settings. 

4-41
• Recoverable and nonrecoverable Powerloss at low (Flight Idle), medium (Cruise), and 

high (Takeoff and Climb) power settings to help determine the potential to detect these 

malfunctions and to help determine the potential to differentiate recoverable and 

nonrecoverable malfunctions at each of these power settings. 

• Nonrecoverable Engine Fail Low (Thrust Shortfall and Subidle), Engine Failed Fixed 

(Thrust Shortfall or Excess), and Engine Fail High (Thrust Overthrust). 

4.1.7.1.4 The PSM Investigation/Study Recommendations. 

It is recommended that Propulsion (task 5.2) investigate/study high by-pass ratio turbofan 

engines for detection potential of the following PSMs: 

• Recoverable and Nonrecoverable Surge at low (Flight Idle), medium (Cruise), and high 

(Takeoff and Climb) power settings to determine the potential to detect these 

malfunctions and to determine the potential to differentiate recoverable and 

nonrecoverable malfunctions at each of these power settings. 

• Precursors to Recoverable and Nonrecoverable Surge. While there is potential for 

engine-related indication, annunciation, and procedure changes to influence/prevent ICR 

of RTO>V1, the potential is small and questionable. For RTO type events, a more 

effective strategy would be to detect and indicate/annunciate PSMs or impending surge 

well below V1. Investigation and analysis should examine engine operation and 

parameters in the seconds and minutes before the malfunction event to determine the 

feasibility/capability of detecting or predicting the malfunction event. Analysis should, 

for example, include and focus upon engine start, taxi, run-up to full thrust, and once at 

full thrust on the extended period before event onset. 

The data indicated that Surge should be a task 5.1 and 5.2 study focus. SDTGE events from the 

PSM+ICR AIA report indicates that tasks 5.1 and 5.2 should select and analyze High By-Pass 

Ratio engine surge events, which initiate at Climb or Cruise power settings and which include 

engine data at lower and idle thrust settings. 

The preponderance of NR engine malfunctions (hard failures of blades, seals, bearings, 

controllers, etc.) indicated that these should be subjects of analysis and study. Again, it is 

recommended that R and NR engine surges be separately and comparatively analyzed with focus 

on NR and differentiating R versus NR events. Finally, it is strongly recommended that 

investigation and analysis be conducted not just at takeoff but throughout the range of possible 

power settings. 

LOC event data also indicated that tasks 5.1 and 5.2 should select and analyze engine powerloss, 

engine rundown, and failure events that initiate or occur at Climb or Cruise power settings and 

that include engine operation at lower and idle thrust settings. LOC event data also indicated 

that some attention should be focused on events that initiate at Takeoff power. It is, therefore, 

recommended that Takeoff power events also be used for purposes of comparing to the mediumand low-power events, and could be used as an alternative to medium and low-power events 

4-42
provided they include sufficient engine data at intermediate and idle thrust settings to support 

analysis. Analysis indicated that R and NR engine powerloss, engine rundown, and failure 

should be separately and comparatively analyzed—with focus on NR and differentiating R 

versus NR malfunctions. 

4.1.7.1.5 Miscellaneous Recommendations. 

• A more comprehensive analysis of the Crew Error Classification versus HF events is 

recommended to provide the insight required to develop effective error prevention 

strategies and designs and assess their effectiveness. 

• It is recommended that a formal process for reporting and documenting in-service ICR be 

developed and implemented. Existing databases should be evaluated for their ability to 

capture and identify ICR-related events. 

• Follow-on research with Engine OEMs and airline operators is recommended to validate 

the PSM data rates, the PSM-based calculations, and the conclusions and 

recommendations in this report. 

4.1.7.2 Traceability Task 2.1 Conclusions and Recommendations. 

The spreadsheet in appendix A contains data selected from each of the 80 turbofan events in the 

AIA PSM+ICR Report event database. The event number for each event is included. 

Additionally, the spreadsheet tables contain columns that document the event/data review. 

Specifically, these columns document the review assessment of PSM recoverability and the 

significance of indications, annunciations, thrust asymmetry, autopilot, and autothrottle to the 

CR. In addition, the columns document the estimated ICR prevention potential of malfunction 

annunciations and the estimated malfunction detection potential. The event number provides 

traceability back to each event in the AIA PSM+ICR Report event database and the AIA report. 

Volume II of the AIA report contains detailed information and a narrative for each event—

organized by ICR and identified by event number. The event number correlates the appendix A 

spreadsheet and AIA Report Volume II. 

The spreadsheets also contain two columns that document task 2.1 output to other/subsequent 

contract tasks: (1) Potential Flight Deck PSM Indications/Annunciations and (2) Recommended 

Propulsion Detection/Investigation/Study PSMs. A subset of these PSMs has been 

recommended for top-level characterization. 

The Potential Flight Deck PSM Indications/Annunciations are output to task 1.2 for Operational 

Assessment of Potential Flight Deck PSM Indications/Annunciations. Where there are multiple 

potential indications/annunciations listed for a given event, they are qualitatively ordered from

most to least likely potential effectiveness. Some are identified with question marks to indicate 

their potential to effect positive change in CR is questionable. 

The Recommended Propulsion Detection Investigation/Study PSMs are output to task 5.1 for 

malfunction characterization and to task 5.2 for Malfunction Investigation/Study of detection 

4-43
potential. The recommendations are qualified wherever possible to identify the specific nature 

of the PSM to aid in selection of PSMs for investigation and study. 

4.2 OPERATIONAL ASSESSMENT OF PSM ANNUNCIATIONS (TASK 1.2). 

This section describes tasks and results involving operational assessment of potential PSM 

indications and annunciations. 

4.2.1 Engine Indication and Crew-Alerting Systems. 

Figure 4-9 illustrates the B777 flight deck layout. This layout is representative of Boeing 

commercial transport aircraft in general, and representative of the layout and location of engine 

and crew-alerting controls and indications in particular. Engine thrust and fuel control levers are 

located on the forward aisle stand. Engine start and other controls are typically located on the 

overhead panel. Engine indications are located on the center forward panel. Crew-alerting 

indications and controls are typically located on the forward and glareshield panels. 

FIGURE 4-9. B777 FLIGHT DECK LAYOUT 

4-44
Figure 4-10 shows the B777 flight EICAS display format. This format is representative of 

Boeing EICAS aircraft. EICAS is displayed on the center forward display. 

FIGURE 4-10. B777 EICAS DISPLAY FORMAT 

The EICAS found on modern U.S.-built transport aircraft were introduced in the 1980s. The 

B757 and B767 were the first Boeing aircraft equipped with EICAS. EICAS was then 

implemented on subsequent Boeing aircraft. The B757/767, B747-400, and the B777, therefore, 

represent a chronological evolution and refinement of EICAS. Within a particular model, e.g., 

the B767, newer derivative versions like the B767-400 incorporate many of the refinements that 

were introduced on later aircraft such as the B747-400 and the B777. Generally however, 

differences within a particular aircraft model are minimized to keep commonality. 

Engine indication and crew alerting differences across the various Boeing airplane models are 

factors that must be considered in analyzing engine malfunction-related UCR and in assessing 

potential remedies. Differences in crew alerting are most significant between the B737 and the

EICAS airplanes (B747-400, B757, B767, and B777). Differences in crew alerting are relatively 

insignificant within the B737 model and within EICAS models. 

Differences in engine indication are greatest within the B737 because the development of the 

various B737 models spans several decades. Differences in engine indication are less within the 

EICAS models, and less between the B737-600/700/800/900 and the EICAS models. The 

display-based indications on the B737-600/700/800/900, B747-400, B757, B767, and B777 

enable a higher degree of cross-model commonality. Table 4-24 documents cross-model EICAS 

differences. 

4-45
TABLE 4-24. CROSS-MODEL ENGINE INDICATION AND CREW-ALERTING SYSTEMS 

Aircraft Model 

Engine 

Manufacturer Engine Indications Alerting System

Number 

In-Service*

B737-200 P&W Electro-Mechanical Dedicated + Master 

Caution 

1144 

B737-300/400/500 CFMI LED Module Dedicated + Master 

Caution 

1987 

B737-600/700/ 

800/900 

CFMI Electronic Display Dedicated + Master 

Caution 

1182 

B747-400 P&W/GE/RR Electronic Display EICAS 581 

B757/767 P&W/GE/RR Electronic Display EICAS 1880 

B777 P&W/GE/RR Electronic Display EICAS 413

* Approximate Q4/2002. 

4.2.2 Engine Indication System. 

Four major transport category high-bypass turbofan engine manufacturers supply Boeing 

aircraft: Pratt & Whitney (P&W), General Electric (GE), Rolls-Royce (RR), and CFM 

International (CFMI). P&W, GE, and RR are used on the B747, B757, B767, and B777 aircraft. 

P&W is used on the B737-200, and CFMI is used on the B737-300 and on subsequent B737 

aircraft models. 

P&W, GE, and CFMI engines are dual-rotor engines, meaning there are two distinct sets of 

rotating components. Therefore, on P&W, GE, and CFMI engines, two engine speeds are 

indicated: N1 and N2. RR engines are trirotor engines, meaning there are three distinct sets of 

rotating components. Therefore, on RR, three engine speeds are indicated: N1, N2, and N3. 

P&W and RR use EPR as the primary thrust-setting parameter. GE and CFMI use N1 as the 

thrust-setting parameter and do not display EPR. 

The following sections provide an overview of engine indications, indication enhancements, and 

indication annunciations on the B777 commercial transport airplane. The B777 was selected to 

overview because of the high degree of commonality between the modern engine indications on 

EICAS (B747-400, B757, B767, and B777) and B737-600/700/800/900 airplanes, and because 

the B777 represents the most current Boeing EICAS implementation. 

Appendix F lists the B737-200, B737-300/400/500, B737-600/700/800/900, and B777 engine 

indications. The spreadsheet shows the historical evolution of engine indications and provide 

background and context, which support report discussions. 

4.2.2.1 Engine Indications. 

Engine indications may be discrete dedicated mechanical instruments/indicators, display-based 

indications, or a combination of dedicated indicators and display indications. On modern 

4-46
transport category aircraft, display-based engine indications are categorized as either primary or 

secondary. Primary engine indications include the thrust-setting parameter and are displayed 

full-time. Secondary engine indications may or may not be displayed full-time. When not 

displayed full-time, secondary engine indications are pilot selectable and also automatically 

display for certain conditions. 

4.2.2.1.1 Primary Engine Indications. 

Figure 4-11 illustrates the full-time B777 primary engine indications display. The following 

indications are provided: 

• EPR (Engine Pressure Ratio)—Primary Thrust Control on P&W and RR engines 

• N1—Primary Thrust Control on GE and CFMI engines 

• EGT 

Note: Total Air Temperature and Thrust Reverser (in-transit and deployed) indications are also 

displayed on the primary engine indication display. 

FIGURE 4-11. B777 PRIMARY ENGINE INDICATIONS 

4-47
4.2.2.1.2 Secondary Engine Indications. 

Figure 4-12 illustrates the part-time pilot selectable B777 Secondary Engine Indications display. 

The following indications are provided: 

• N2 (Engine core speed. Engine intermediate spool speed on a three-spool engine.) 

• N3—RR only. (Engine core speed on a three-spool engine.) 

• Fuel Flow 

• Oil Pressure 

• Oil Temperature 

• Oil Quantity 

• Vibration 

FIGURE 4-12. B777 SECONDARY ENGINE INDICATIONS 

4.2.2.1.3 Additional Engine Indications/Parameters. 

Additional engine parameters are available on other displays, but are provided for maintenance 

purposes, and are not intended for flight crew use. Generally, these parameters are available 

from the Electronic Engine Control (EEC) or FADEC. Certain parameters, e.g., Thrust Lever 

Angle, are indicated only on maintenance display formats and currently support engine 

indication features such as commanded thrust indication. Other parameters, alone or in 

combination, may be used to support potential new indications, new indication features, and new 

indication annunciations/alerts. 

4-48
4.2.2.2 Engine Indication Annunciations and Alerts. 

The following paragraphs summarize B777 airplane engine indication annunciations and alerts. 

With exceptions, the engine indication annunciations described are generally provided on all 

EICAS and B737-600/700/800/900 airplanes. 

4.2.2.2.1 Automatic Display of Secondary Engine Indications. 

The B777 and other EICAS airplane secondary engine indications are automatically displayed 

when:

• the displays initially receive electrical power. 

• a FUEL CONTROL switch is moved to CUTOFF in flight. 

• an engine fire switch is pulled in flight. 

• a secondary engine parameter is exceeded. 

• engine N2 or N3 revolutions per minute (rpm) is below idle in flight. 

When the secondary engine parameters are automatically displayed due to any of the listed 

conditions, they cannot be cleared until the condition is no longer present. 

B737 secondary engine indications are automatically displayed when 

• the Common Display System initially receives power. 

• selected by the Multifunction Display (MFD). 

• in flight, an engine start lever moved to CUTOFF. 

• in flight, an engine fails. 

• a secondary engine parameter exceeds normal operating range. 

When the secondary engine indications are automatically displayed, they cannot be cleared until 

the condition is no longer present. 

4.2.2.2.2 B777 Engine Indications, Annunciations, and Alerts. 

Commanded thrust is indicated for EPR (P&W and RR) and N1 (GE and CFMI). This 

indication is provided on the EPR or N1 indication on all EICAS and B737-600/700/800/900 

airplanes. 

The N1, N2, N3, EGT, oil pressure, and oil temperature indications have operating limits 

indicated by red lines. If one of these indications reaches the red line, the digital readout, box, 

and pointer change color to red for that indication. EPR exceedances are not annunciated. Note: 

If an N1, N2, N3, or EGT red line is exceeded, the box enclosing the digital readout remains red 

after the exceeded limit returns to the normal range. The red box color can be canceled to white 

or recalled to red by pushing the cancel/recall switch on the display select panel. An indication 

changes color back to white when it returns to the normal operating range. 

4-49
The EGT indication has a maximum takeoff limit displayed by a red line. If EGT reaches the 

maximum takeoff limit, the digital indication, box, pointer, and dial all change color to red. The 

indication displays amber when maximum continuous limit is reached. 

The oil pressure vertical indications have caution ranges displayed by amber bands. If oil 

pressure reaches the caution range, the digital readout, digital readout box, and pointer all change 

color to amber. An engine-specific EICAS caution alert is also provided—ENG OIL PRESS 

L/R. 

The oil temperature vertical indications have caution ranges displayed by amber bands. If oil 

temperature reaches the caution range, the digital readout, digital readout box, and pointer all 

change color to amber. An engine-specific EICAS advisory alert is also provided—ENG OIL 

TEMP L/R. 

For low oil quantity, the oil quantity digital readout changes to black text on a white background. 

The white text LO is displayed adjacent to the readout. 

For high engine vibration, the vibration digital readout changes to black text on a white 

background. 

4.2.2.2.3 B777 Engine Alerts. 

Engine-specific EICAS alerts are provided for engine fail subidle, thrust shortfall, engine 

shutdown, low oil pressure, and high oil temperature. The following EICAS alerts are provided. 

• ENG FAIL L or ENG FAIL R 

• ENG THRUST L or ENG THRUST R 

• ENG SHUTDOWN L or ENG SHUTDOWN R 

• ENG OIL PRESS L or ENG OIL PRESS R 

• ENG OIL TEMP L or ENG OIL TEMP R 

• And alerts for various other engine system failures or nonnormal conditions and 

configurations. 

4.2.2.2.4 B777 Compact Display Format. 

In compact format, primary and secondary engine indications are combined on the same display. 

4.2.2.2.4.1 Pratt & Whitney Engines. 

The EPR and N1 displays are the same as the normal displays. All other indications change to 

digital readouts only. If an amber or red-line parameter for a digital indication is exceeded, the 

digital indication changes color to amber or red (as does the box that appears around an EGT or 

4-50
an N2 indication for a red-line exceedance). If the EGT or N2 red line is exceeded, the red color 

of the box around the digital indication can be returned to white (if the exceeded parameter has 

returned to normal) by pushing the display select panel CANCEL/RECALL switch. 

4.2.2.2.4.2 General Electric Engines. 

The N1 and EGT indications are displayed as they are normally (moving pointer/round dial and 

digital indications). All other indications change to digital readouts only, with the exception that 

the N2 digital readout is boxed if a parameter is exceeded. If an amber or red-line parameter for 

a digital indication is exceeded, the digital indication changes color to amber or red (as does the 

box that appears around the N2 indication for a red-line exceedance). If the N2 red line is 

exceeded, the red color of the box around the digital indication can be returned to white (if the 

exceeded parameter has returned to normal) by pushing the display select panel CANCEL/ 

RECALL switch. 

4.2.2.2.4.3 Rolls-Royce Engines. 

The EPR and N1 displays are the same as the normal displays. All other indications change to 

digital readouts only. If an amber or red-line parameter for a digital indication is exceeded, the 

digital indication changes color to amber or red (as does the box that appears around an EGT, 

N2, or N3 indication). If the N1, N2, N3, or EGT red line is exceeded, the red color of the box 

around the digital indication can be returned to white (if the exceeded parameter has returned to 

normal) by pushing the display select panel CANCEL/RECALL switch. 

Primary and secondary engine indications are displayed on EICAS in compact format whenever: 

• the secondary engine display is automatically selected and the lower MFD is failed, 

unpowered, or is occupied. 

• the secondary engine display is manually selected to the lower center MFD, and when the 

lower MFD is failed, unpowered, or occupied with EICAS. 

4.2.3 Crew-Alerting Systems. 

The centralized crew-alerting systems (CAS) found on modern U.S.-built transport aircraft were 

introduced in the 1980s. These systems were based on FAA-funded research intended to 

standardize crew alerting. The B757 and B767 were the first Boeing aircraft to implement 

EICAS. The B747-400 was the first Boeing aircraft to implement EICAS as the primary means 

of crew alerting, and the B777 followed and further refined EICAS. The B737 is a pre-EICAS 

airplane and as such does not incorporate many of the CAS elements and features found in 

EICAS. However, the specific means of B737 crew alerting is equivalent to EICAS. Therefore, 

the differences are not detailed or compared. Both the EICAS and the B737 provide appropriate, 

acceptable, and effective crew alerting. Any proposed annunciations should be implemented in a 

manner consistent with the applicable aircraft indications and alerting systems. 

4-51
The following sections provide an overview of the B777 CAS. The B777 was selected for 

overview because of the high degree of commonality between the EICAS airplanes (B747-400, 

B757, B767, and B777), because the B777 represents the most current Boeing EICAS 

implementation, and because the B777 CAS is the current baseline for future Boeing aircraft. 

4.2.3.1 General. 

The principal elements of centralized crew alerting on EICAS airplanes are 

• A combined Master Warning Light (MWL)/Master Caution Light (MCL) and reset 

switch in the primary forward field of view. Two are installed: one located on the 

glareshield directly in front of each flight crew member. The upper half of this reset 

switch is a red indication light labeled WARNING. The lower half of this reset switch is 

an amber indication light labeled CAUTION. These lights illuminate whenever a 

warning or caution alert message is displayed in the EICAS message area. Pushing the 

reset switch extinguishes the light and in some warning cases silences the associated 

warning aural. 

• Warning and Caution aurals. A warning aural sounds whenever the MWL illuminates. 

A limited number of unique warning aurals are used to differentiate certain warning 

groups, e.g., Bell for fires, Siren for configuration warnings, etc. An EICAS caution 

aural (four short consecutive beeps) sounds whenever the MCL illuminates. The same

aural is used for all caution alerts. 

• An EICAS message alert field, shown in figure 4-10. Alert messages are prioritized, 

time-ordered, and color- and position-coded. Alert messages can be cancelled and 

subsequently recalled. 

4.2.3.2 Engine Indication and Crew-Alerting System Alert Levels. 

The following definitions are used to establish the appropriate level and means of EICAS 

alerting for both airframe and nonairframe systems-related alerting. These alert-level definitions 

are consistent with B737 crew alerting. 

• Time-critical warning alerts are used where immediate, usually memorized, flight pathrelated crew action is required. The aural component of time-critical warning alerts is a 

voice message such that secondary references are not necessary prior to taking action. 

The visual components are red. Typical time-critical warnings on EICAS airplanes 

consist of a red glareshield MWL, a synthetic voice aural, and an accompanying red text 

message on the PFD, e.g., WINDSHEAR or ENG FAIL. 

• Warning alerts are used where immediate crew awareness and timely crew action is 

required. The visual components of warnings are red. The aural component of warning 

alerts is an aural tone. Typical EICAS warnings consist of a red glareshield MWL, an 

aural tone, and an accompanying red text message on the EICAS display. 

4-52
• Caution alerts are used where immediate crew awareness is required and subsequent crew 

action may be required. The visual components of cautions are amber. The aural 

component of EICAS caution alerts is a single unique caution tone. Typical EICAS 

caution alerts consist of an amber glareshield MCL, a caution aural tone, and an 

accompanying amber text message on the EICAS display. 

• Advisory alerts are used where routine crew awareness is required. Subsequent crew 

action may be required. The visual components of advisories are amber. There is no 

immediate awareness requirement and thus no aural component requirement for advisory 

alerts. Typical EICAS advisory alerts consist of an amber text message on the EICAS 

display, indented to differentiate amber advisory and caution EICAS messages. 

4.2.3.3 Engine Indication and Crew-Alerting Systems Inhibits. 

Nonnormal alert annunciations (indications, master warning/caution lights, aural tones, and 

messages) are partly or wholly inhibited during certain phases of operation, e.g., Pre- and PostFlight, Engine Start, Engine Shutdown, Takeoff, and Landing. The purpose of such inhibits is to 

eliminate, operationally, unnecessary or inappropriate indications and to ensure the flight crew is 

not distracted during high workload critical phases of flight operation. Takeoff and landing 

inhibits, in particular, are used to guard against undesired flight crew responses such as RTO 

above V1 or unnecessary go-around on short final. The following sections document selected 

inhibits relevant to Task 1.2 Operational Assessment. 

4.2.3.3.1 Takeoff Inhibits. 

All advisory-level EICAS alert messages, MCLs, and caution aural are inhibited from 80 knots 

to 400′ radar altitude or 20 seconds after rotation. Caution messages are not inhibited. An 

option is available to inhibit to 800′ radar altitude or 30 seconds after rotation. 

The MCLs and caution aural for engine failure are inhibited from 65 kts to 400′/800′ radar 

altitude or 20/30 seconds after rotation. The engine failure voice alert, associated MWLs, and 

PFD ENG FAIL indications are inhibited beginning just prior to V1. 

MWLs and aurals are inhibited from V1 to 400′ radar altitude or 25 seconds after inhibit begins. 

Warning messages are not inhibited. Takeoff configuration warning alerts (MWLs, aurals, and 

messages) are inhibited from V1 to landing. 

EGT indications are inhibited from changing to amber during takeoff or go-around for 5 minutes. 

4.2.3.3.2 Landing Inhibits. 

MCLs and caution aural are inhibited from 200′ radar altitude to 75 kts for all but a selected set 

of caution alerts directly relevant to the approach and landing operation (e.g., AUTOPILOT, NO 

AUTOLAND, AUTOTHROTTLE DISC, SPEEDBRAKES EXTENDED, etc.). Caution 

messages are not inhibited. 

4-53
4.2.3.3.3 Other. 

In takeoff, landing, and other phases of flight, the automatic display of secondary engine 

indications varies between models. In general, the current design and operational philosophy is 

that amber (caution or advisory level) engine indication annunciations should not automatically 

display during takeoff. Secondary engine indications are generally automatically displayed for 

red exceedance (warning level) indications and for other conditions previously described. 

Display (automatic or not) for vibration is implemented differently on different Boeing models 

due to differing vibration system designs and detection capabilities, the difficulty of establishing 

meaningful engine vibration annunciation levels, and operational concepts and FAA policies 

existing at the time of design certification. With possible exceptions, on the B757/767, the 

secondary engine indications are required to be displayed continuously during takeoff because 

there is no high vibration level established for automatic pop-up for vibration. On the B747-400, 

continuous display was considered undesirable, so a high vibration level was established and is 

automatically displayed during takeoff, or during any flight phase, for vibration at this level. On 

the B777, automatic display during takeoff for vibration was considered undesirable, so the 

automatic display for vibration is inhibited during takeoff (but is not inhibited for other phases of 

flight). On the B777, continuous display of the secondary engine indications is not required 

during takeoff. 

4.2.4 Flight Deck Design and Operational Philosophy, Requirements, and Guidelines. 

Appendix G contains a set of selected generalized flight deck design and operational 

philosophies and interface design requirements and guidelines applicable to transport category 

commercial airplanes. These selected objectives, guidelines, and requirements are applicable to 

the design and development of flight deck controls, indications, and annunciations in general, 

and engine-related indications and annunciations in particular. The objectives, guidelines, and 

requirements are also relevant to the operational assessment of new indications and 

annunciations intended to prevent or reduce engine malfunction-related UCR, and they are a 

basis for the conclusions and recommendations herein. The objectives, guidelines, and 

requirements are provided to aid in understanding how report conclusions and recommendations 

are reached. Also included in appendix G are applicable Title 14 Code of Federal Regulations*

and Advisory Circular (AC) guidance. The following paragraphs contain key excerpts from

appendix G. 

4.2.4.1 Flight Deck Design and Operational Philosophy. 

The operational hierarchy, listed in order of importance to flight safety, is: 

• Flight path control 

• Navigation/guidance 

 *

 Title 14 Code of Federal Regulations is referred to as Federal Aviation Regulations (FAR) herein. 

4-54
• Aircraft separation 

• Communication 

• System operation 

System designs should adhere to proven design concepts of simplicity, fault tolerance, error 

tolerance, and appropriate use of redundancy and automation. 

Human engineering design principles should be used, and human factors considered, as part of 

the flight deck interface design process. These principles should be used to provide a safe, 

efficient, and comfortable working environment. 

Crew Alerting and Systems design should correlate with Flight Crew Training philosophy. In 

particular, the Flight Crew Training philosophy is reflected in flight deck alerting and switch 

labeling. The training paradigm is to provide the flight crew with an appropriate awareness of 

nonnormal conditions, a procedure where crew action is required, and an accurate description of 

all systems controls and what they actually control. This philosophy paradigm provides accurate 

mental models of system state and configuration, what system controls actually do, and how 

each system fits into the overall architecture. Since it is not possible to provide checklist 

procedures for all conceivable situations, flight crews may have to use system controls for 

purposes other than the primary intended purpose. Accurate systems knowledge reduces the 

potential for erroneous use of controls in these unanticipated situations. 

Alerting should be implemented based on a demonstrable need for crew awareness or action and 

minimal risk of inappropriate or undesired crew distraction, response, or desensitization. 

Alert presentations must not degrade flight operations. 

Flight deck design should optimize pilot workload. The design should allow pilots to focus on 

total flight operations rather than on subsystem monitoring, control, troubleshooting, or problem

solving. 

4.2.4.2 Flight Deck Interface Design Guidelines and Requirements. 

The following are generalized flight deck interface design requirements and guidelines 

applicable to the development of engine indications and annunciations. These requirements and 

recommendations are also relevant to the operational assessment of new indications and 

annunciations and are a basis for the conclusions and recommendations herein. 

• Primary flight and thrust controls must incorporate visual and tactile feedback to the 

flight crew. 

• The consequences of false or nuisance alerting should be assessed, and the potential for 

false or nuisance alerting must be minimized. 

• The consequences of failure to alert must be assessed, and the potential for failure to alert 

should be minimized. 

4-55
• Alert presentations must provide combinations of visual, aural, or tactile elements to 

attract attention and define the alert condition sufficiently for appropriate crew action or 

awareness. 

• Alert conditions must be indicated on the forward panels such that determination of when 

to take action can be made by the pilot without further reference. 

• Alert annunciations must automatically clear when the alert condition no longer exists. 

• System information should be automatically displayed, or be readily available, when the 

information is required to assess a failure or take action. 

4.2.4.3 Applicable Federal Aviation Regulations. 

4.2.4.3.1 Power Plant Instruments, FAR 25.1305. 

FAR 25.1305 documents FARs applicable to Power Plant Instruments. The following FAR 

25.1305 excerpts document-required power plant instruments applicable to this operational 

assessment. 

25.1305 (c) For turbine engine-powered airplanes: 

(1) A gas temperature indicator for each engine. 

(2) A fuel flowmeter indicator for each engine. 

(3) A tachometer (to indicate the speed of the rotors with established limiting speeds) for each 

engine. 

25.1305 (d) For turbojet engine powered airplanes: 

(1) An indicator to indicate thrust, or a parameter that is directly related to thrust, to the pilot. 

The indication must be based on the direct measurement of thrust or of parameters that are 

directly related to thrust. The indicator must indicate a change in thrust resulting from any 

engine malfunction, damage, or deterioration. 

(2) A position indicating means to indicate to the flight crew when the thrust reversing device is 

in the reverse thrust position, for each engine using a thrust reversing device. 

(3) An indicator to indicate rotor system unbalance. 

4.2.4.3.2 Equipment, Systems, and Installations, FAR 25.1309. 

The following applicable requirements are excerpted from FAR 25.1309. 

FAR 25.1309, Equipment, Systems, and Installations: 

(a) The equipment, systems, and installations whose functioning is required by this subchapter, 

must be designed to ensure that they perform their intended functions under any foreseeable 

operating condition. 

(b) The airplane systems and associated components, considered separately and in relation to 

other systems, must be designed so that: 

4-56
(1) The occurrence of any failure condition which would prevent the continued safe flight 

and landing of the airplane is extremely improbable, and 

(2) The occurrence of any other failure conditions which would reduce the capability of the 

airplane or the ability of the crew to cope with adverse operating conditions is 

improbable. 

(c) Warning information must be provided to alert the crew to unsafe system operating 

conditions, and to enable them to take appropriate corrective action. Systems, controls, and 

associated monitoring and warning means must be designed to minimize crew errors which 

could create additional hazards. 

(d) Compliance with the requirements of paragraph (b) of this section must be shown by 

analysis, and where necessary, by appropriate ground, flight, or simulator tests. The 

analysis must consider: 

(1) Possible modes of failure, including malfunctions and damage from external sources. 

(2) The probability of multiple failures and undetected failures. 

(3) The resulting effects on the airplane and occupants, considering the stage of flight and 

operating conditions, and 

(4) The crew warning cues, corrective action required, and the capability of detecting faults. 

4.2.4.3.3 Cathode Ray Tube Certification, AC 25-11. 

AC 25-11 provides guidance for certification of cathode ray tube (CRT)-based electronic display 

systems used for guidance, control, or decision-making by the pilots of transport category 

airplanes. The AC states in paragraph 4.a “The use of electronic displays allows designers to 

integrate systems to a much higher degree than was practical with previous airplane flight deck 

components. With this integration can come much greater simplicity of operation of the airplane 

through automation of navigation, thrust, airplane control, and the related display systems.” 

Information Separation g. Attention-Getting Requirements. (1) Some electronic display 

functions are intended to alert the pilot to changes: navigation sensor status changes (VOR flag), 

computed data status changes (flight director flag or command cue removal), and flight control 

system normal mode changes (annunciator changes from armed to engaged) are a few examples. 

For the displayed information to be effective as an attention-getter, some easily noticeable 

change must be evident. A legend change by itself is inadequate to annunciate automatic or 

uncommanded mode changes. Color changes may seem adequate in low light levels or during 

laboratory demonstrations but become much less effective at high ambient light levels. Motion 

is an excellent attention-getting device. Symbol shape changes are also effective, such as 

placing a box around freshly changed information. Short-term flashing symbols (approximately 

10 seconds or flash until acknowledge) are effective attention-getters. A permanent or long-term

flashing symbol that is noncancellable should not be used. 

4.2.5 Operational Assessment. 

Task 2.1 identified the following propulsion system malfunctions, symptoms, and effects as 

potential flight deck annunciations for operational assessment of their potential to prevent or 

reduce the occurrence of PSM+ICR events. 

4-57
• Powerloss—Engine Failure (subidle/flameout/etc.) or Thrust Shortfall (commanded 

thrust > actual thrust) 

• Surge—Recoverable with Crew Action or Nonrecoverable 

• Failed Fixed Thrust—Stuck Throttle, Thrust Shortfall (commanded thrust > actual 

thrust), Overthrust (commanded thrust < actual thrust) 

• High Vibration 

• Thrust Asymmetry 

These potential annunciations are applicable to all flight phases and power settings in general, 

and to Takeoff Climb, Cruise, and Approach/go-Around flight phases and power settings in 

particular. Alert annunciations during takeoff roll above V1, during takeoff climb, and during 

approach and landing are often inhibited or limited because of their potential to unnecessarily 

distract the crew and prompt undesired RTO above V1, or unnecessary Go-Around. 

The following sections reiterate the safety concerns identified in task 2.1, provide additional 

task 2.1 data analysis, and assess the potential of the annunciations listed above to address UCR 

to engine malfunctions. Additional sections assess existing annunciations and the benefits and 

risks associated with new/additional annunciations. 

4.2.5.1 Safety Concerns and Focus—Task 2.1 Data Analysis. 

As noted in the task 2.1 report: For the purposes of hazard analysis, the number of fatalities was 

considered the primary objective measure of the actual and potential hazard, and the potential 

safety benefit, associated with each ICR category. 

Twelve of the 81 AIA PSM+ICR Report events involved fatalities. Table 4-25 summarizes these 

HF events by crew response category and associated malfunctions. The table is organized from

most to least number of HF events. For Powerloss and Surge events, the primary malfunction is 

listed first, with secondary or consequential malfunction listed second. Most, but not all, LOC 

and Other events involved no survivors. Most of the people involved in the RTO>V1 event 

survived. 

Table 4-25 shows that for HF events: 

• Powerloss is associated with LOC, Other, and SDGE events—the three crew response 

categories, which account for the majority of HF events and fatalities. Powerloss is not 

associated with RTO>V1 HF events, and is not the primary PSM in Shutdown Good 

Engine HF events. 

• Surge is associated with all types of HF crew response events. Surge is not the primary 

PSM in LOC HF events. 

4-58
• Stuck Throttle, which is equivalent in important respects to engine failed fixed thrust, is 

associated primarily with LOC HF events. 

TABLE 4-25. INAPPROPRIATE CREW RESPONSES TO PSMs AND 

ASSOCIATED SAFETY DATA 

CR Propulsion System Malfunction 

Number of 

HF Events

Number of 

Fatalities 

LOC Powerloss w/Surge (Engine Fail Low) 5 135 

Stuck Throttle (Engine Failed Fixed Thrust) 2 201 

Other Powerloss w/Surge (Engine Fail Low) 2 9 

Surge w/Powerloss (Engine Fail Low) 1 35 

SDGE Surge w/Powerloss 1 47

RTO>V1 Surge 1 3

Table 4-26 summarizes each HF event. Within each category of crew response, the table is 

organized first by phase of flight and then by the altitude at which the malfunction occurred. 

The AIA report event number is listed along with a brief narrative and an estimate of the crew 

response prevention potential and malfunction detection potential. 

Table 4-26 shows that the HF events listed occur in Takeoff Climb, Cruise Climb, Descent, and 

Approach/Go-Around. However, most events occurred in the Takeoff Climb phase (8 of 12), 

and most of those occurred below 400 feet AGL (5 of 8). The flight phase distribution of HF 

malfunctions and events is representative of the overall AIA report events in general. Therefore, 

addressing the HF events in particular is expected to address AIA report events in general. 

As table 4-26 shows, in most cases, the degree of malfunction awareness cannot be determined 

from event data. However, it can often be inferred from event data that the crew was initially 

either unaware that a PSM existed, unaware of the specific engine affected, or unaware of the 

nature of the PSM. For example, in the SDGE case listed in table 4-26, the crew was aware of a 

malfunction, but unaware of which engine was actually affected. 

Of the 12 HF events in table 4-26, 58% (7 of 12) occurred outside the EICAS alert takeoff and 

approach phase inhibits, described in section 4.2.3.3. The remaining 42% of events (5 of 12) 

occurred within the EICAS alert takeoff inhibit period. Therefore, EICAS alerts in general, and 

EICAS alert attention getters such as the MCLs and aural in particular, are available in the 

majority of these events. For those events occurring during EICAS alert inhibits, the engine 

indication annunciations, it is envisioned, could accompany and complement each alert and 

might provide sufficient crew awareness to produce the desired crew response. However, such 

indication annunciations could only be provided if implemented in a manner that would 

acceptably minimize the risk of them causing an RTO>V1 or other UCR. 

4-59
TABLE 4-26. INAPPROPRIATE CREW RESPONSES TO PSMs AND 

ASSOCIATED EVENTS 

LOC 

No. of 

Engines 

Flight Phase 

(Altitude) Malfunction Recoverability

Malfunction 

Awareness 

Number of 

Fatalities 

2 T/O Climb

(UNK Low >L/O) 

Powerloss (Engine 

Fail Low) 

NR Yes 7

No. 34. Engine no. 1 failed shortly after takeoff. Crew rushed air turn back, selected flaps and gear down 

simultaneously and attempted a downwind landing. Banking to final approach, the aircraft wingtip contacted the 

ground and the airplane crashed. No Prevention potential. Detection potential.

4 T/O Climb

(UNK Low >L/O) 

Powerloss w/Surge 

(Engine Fail Low) 

UNK UNK 3

No. 37. The airplane had aborted takeoff and returned to hanger for engine maintenance because the no. 4 engine 

was making popping sounds above 1.7 EPR. Cargo was offloaded and after takeoff the airplane veered to the right

and crashed. Prevention potential unknown. Detection potential unknown. 

2 T/O Climb (450′) Powerloss (Engine 

Fail Low) 

NR UNK 31

No. 43. After takeoff, smoke and fire were reported coming from the right engine. The aircraft climbed to 700 

feet AGL then rolled into a steep bank and crashed on airport property in a nose-down attitude. Catastrophic 

engine failure was listed as a contributing factor. Prevention potential unknown. Detection potential. 

2 T/O Climb (1500′) Stuck Throttle 

(Engine Fail Fixed at

Mid Power) 

R No 60

No. 74. With autothrottle engaged, R throttle stuck above climb power which caused L throttle to move to idle 

over a 42-second period. Bank angle increased due to thrust asymmetry and aircraft rolled, inverted, and nosedown crashed at high speed. Prevention potential. Detection potential. 

2 Descent (7200′) Stuck Throttle 

(Engine Fail Fixed at

Idle Power) 

R No 141

No. 61. With autopilot and autothrottle engaged, R throttle stuck at idle on level off. As L engine power 

increased, autopilot compensated with aileron. As L engine thrust approached 80%, the airplane began to bank 

right. Passing 50 degrees right bank, right roll control wheel input occurred and the right throttle was advanced. 

With symmetrical thrust, right bank continued to increase and the airplane crashed at high thrust, high speed, in a 

nose-low 155 degree right bank. Prevention potential. Detection potential. 

2 Approach/GoAround (200′) Powerloss w/Surge 

(Engine Fail Low) 

NR UNK 71

No. 77. Structural failure of first stage compressor blade led to powerloss. Crew initially unaware of engine

malfunction and single-engine operation, allowed irreversible loss of airspeed. Event data indicates that the engine

malfunction initiated on approach. Prevention potential. Detection potential. 

2 Approach/GoAround (300′) Powerloss (Engine 

Fail Low) 

UNK UNK 23

No. 10. Crew initiated go-around. Loss of thrust/engine failure contributed to loss of control. It is assumed that 

the crew did not initially realize that an engine malfunction existed. Prevention potential. Detection potential. 

4-60
TABLE 4-26. INAPPROPRIATE CREW RESPONSES TO PSMs AND 

ASSOCIATED EVENTS (Continued) 

Other 

No. of 

Engines 

Flight Phase 

(Altitude) Malfunction Recoverability

PSM 

Awareness 

Number of 

Fatalities 

4 T/O Climb (125′) Powerloss w/Surge UNK UNK 4 

No. 81. After takeoff, the aircraft apparently failed to climb and struck a radio mast on rising ground about 4.5 

miles beyond the end of the runway. Report stated the no. 4 engine may have failed and the cowl from the no. 3 

engine was found on the runway. Prevention potential unknown. Detection potential unknown. 

2 T/O Climb (300′) Surge w/Powerloss 

(Dual Engine Fail

Low) 

UNK UNK 35

No. 51. Both engines began continuous surge due to bird strike shortly after liftoff. A climb to 1400 feet AGL 

was accomplished, but both engines quit running during the following air turn back and the aircraft crashed in a 

clearing. Prevention potential. Detection potential. 

4 T/O Climb (2000′) Powerloss w/Surge 

(Engine Fail Low) 

NR? UNK 5

No. 1. The no. 2 engine failed 1 minute after takeoff. Compressor disk cut the fuel line resulting in a fuel fire, 

and the crew failed to close the pylon shutoff valve and failed to shutoff the boost pumps. On approach, the no. 3 

engine fell off. Prevention potential unknown. Detection potential unknown. 

SDGE 

No. of 

Engines 

Flight Phase 

(Altitude) Malfunction Recoverability

PSM 

Awareness 

Number of 

Fatalities 

2 Cruise Climb 

(29,000′) 

Surge NR Yes 47

No. 53. Approaching 29,000 feet in climb, the left engine surged. Crew reduced power on both engines, 

declared an emergency, and subsequently shutdown the right engine believing it to be the affected engine. On 

approach, the left engine failed after power was increased. Attempt to restart the right engine was unsuccessful

and the aircraft crashed short of the runway. Prevention potential. Detection potential. 

RTO>V1 

No. of 

Engines 

Flight Phase 

(Altitude) Malfunction Recoverability

PSM 

Awareness 

Number of 

Fatalities 

3 After Liftoff (9′) Surge w/Powerloss NR UNK 3 

No. 78. Shortly after rotation and liftoff, a loud bang and powerloss occurred, and the flight crew aborted the 

takeoff. Prevention potential unknown. Detection potential.

4.2.5.2 Inappropriate Crew Response Prevention Potential. 

Prevention potential is the estimated opportunity, through PSM annunciation, to prevent or 

mitigate ICR by providing timely awareness, correct understanding, and linkage to the 

appropriate nonnormal procedure. As previously noted in the task 2.1 report, the LOC, SDGE, 

and Other event data suggest that annunciations that identify the presence of a PSM, identify the 

affected engine(s), and identify the specific type of PSM offer potential for ICR prevention and 

risk mitigation. 

4-61
The determinations of prevention potential in this report are best estimates made based on 

available and often limited data and somewhat subjective judgments. The judgment that 

prevention potential exists, indicates only that opportunity appears to exist and that prevention 

may be possible. Uncertainty as to the degree of prevention potential exists in all cases where 

prevention potential has been identified. While it may appear possible that malfunction 

annunciation has the potential to prevent PSM-related ICR, there is no unequivocal certainty that 

malfunction annunciation would prevent these events. Where prevention potential has been 

identified, the degree of potential may range from low to high. Therefore, positive assessments 

of prevention potential should not be interpreted to mean that the event would have been 

prevented. In all cases where prevention potential has been judged to exist, it means that only 

the event might have been prevented. 

Note that the following assessments of prevention potential are made only with respect to 

malfunction annunciation. Where malfunction annunciation potential has been assessed to exist, 

there may be other, alternative interventions with equal or greater prevention potential. Where 

malfunction annunciation potential has been assessed to not exist, there may be other 

interventions that do provide prevention potential. 

4.2.5.2.1 The AIA Report HF and H Event Prevention Potential Assessment. 

Table 4-27 documents the estimated potential for malfunction annunciations to prevent or reduce 

the occurrence of UCR in the AIA report HF and H events. 

• 43% of the HF and H events (10 of 23) are estimated to have prevention potential. 

• 30% of HF and H events (7 of 23) appear to have no prevention potential.

• Prevention potential could not be determined in 27% of events (6 of 23) and was, 

therefore, listed as unknown. 

• HF events with prevention potential account for 88% of all PSM+ICR-related fatalities 

(377 of 430). 

Table 4-27 also documents the estimated malfunction detection potential. It is estimated that the 

majority of malfunctions are detectable. The principal detection issue is reliable and meaningful 

detection, particularly in the case of surge. Note that the estimated potential for malfunction 

detection does not include or represent an assessment of detection reliability. 

Tables 4-28, 4-29, and 4-30 correlate malfunction, crew response, and estimated prevention 

potential. The tables summarize the estimated potential malfunction annunciations have to 

prevent or reduce the UCRs associated with HF and H events. Cases where the prevention 

potential could not be determined (i.e., was indeterminate) are also included to show where 

addition prevention potential might exist. 

4-62
TABLE 4-27. ESTIMATED ICR PREVENTION POTENTIAL—AIA REPORT 

HF AND H EVENTS 

No. and 

Type of 

Events 

Crew 

Response Crew Response Prevention Potential Malfunction Detection Potential1

12 HF 7 LOC 

3 Other 

1 SDGE 

1 RTO>V1 

6 (50%) With Prevention Potential 

1 (8%) No Prevention Potential2

5 (42%) Unknown Prevention 

Potential 

10 (83%) With Detection 

Potential 

2 (17%) Unknown Detection 

Potential 

11 H 2 LOC 

3 Other 

1 TGE 

5 RTO>V1 

4 (36%) With Prevention Potential 

6 (55%) No Prevention Potential2

1 (9%) Unknown Prevention 

Potential 

7 (64%) With Detection Potential 

2 (18%) Unknown Detection 

Potential 

2 (18%) Not Applicable 

1. Does not include, consider, or assess the reliability with which detection could be accomplished. Includes 

three special cases where the relationship between malfunction and CR is questionable, and three RTO>V1 events. 

2. Assessments do not include, or rule out, prevention potential from other kinds of interventions. 

TABLE 4-28. ESTIMATED ICR PREVENTION POTENTIAL—12 AIA 

REPORT HF EVENTS 

7-LOC 4 PP, 

1 NP, 2 IP 

3-Other 

1 PP, 2 IP 

1-SDGE 

1 PP 

1-RTO>V1 

1 IP 

Powerloss 

(Fail Low)

2 

x 

x

Surge X 1

x 

1 x

Stuck Throttle 

(Fail Fixed) 

2

PP=Prevention Potential. NP=No Potential. IP=Indeterminate Potential. x= Indeterminate Potential. 

TABLE 4-29. ESTIMATED ICR PREVENTION POTENTIAL—11 AIA REPORT H 

EVENTS 

2-LOC 

1 PP, 1 NP 

3-Other 

1 PP, 1 NP, 1 IP 

1-TGE 

1 PP 

5-RTO>V1 

1 PP, 4 NP 

Powerloss 

(Fail Low)

1 1

Surge 1

x 

1

Stuck Throttle 

(Fail Fixed) 

PP=Prevention Potential. NP=No Potential. IP=Indeterminate Potential. x= Indeterminate Potential. 

4-63
TABLE 4-30. COMBINED ICR PREVENTION POTENTIAL—23 AIA REPORT HF 

AND H EVENTS 

9-LOC 5 PP, 

2 NP, 2 IP 

6-Other 

2 PP, 1 NP, 3IP 

2-SDTGE 

2 PP 

6-RTO>V1 

1 PP, 4 NP, 1 IP 

Powerloss 

(Fail Low)

3 

x 

x 1

Surge X 2

xx 

2 x

Stuck Throttle 

(Fail Fixed) 

2

PP=Prevention Potential. NP=No Potential. IP=Indeterminate Potential. x= Indeterminate Potential. 

Table 4-30 shows: 

• With respect to crew response, most prevention potential exists in the area of LOC, 

followed by Other and Shutdown or TGE. Least prevention potential exists in the area of

RTO>V1. 

• With respect to malfunctions, most prevention potential is associated with Powerloss and 

Surge, followed by Stuck Throttle (e.g., Failed Fixed Thrust) malfunctions. 

4.2.5.2.2 The AIA Report S and I Event Prevention Potential Assessment. 

The remaining 58 S and I events in the AIA report were assessed for prevention and detection 

potential. 

Overall, 93% of the S and I events are estimated to have detection potential. Table 4-31 

documents the assessment of malfunction annunciation potential to prevent or reduce UCR in 

these events. 

• 24% of S and I events are estimated to have prevention potential (14/58) 

• 38% of S and I events appear to have no prevention potential (22 of 58) 

• Prevention potential could not be determined in the remaining 38% (22 of 58) and was, 

therefore, listed as unknown. 

Neglecting the 24 RTO>V1 events, which as a group are estimated to have little or no potential 

for prevention through PSM annunciation, for the remaining 34 S and I events: 

• 41% of S and I events have prevention potential (14 of 34) 

• 24% of S and I events have no prevention potential (8 of 34) 

• Prevention potential is unknown in the remaining 35% (12 of 34). 

4-64
TABLE 4-31. ESTIMATED ICR PREVENTION POTENTIAL—AIA REPORT S 

AND I EVENT TYPES 

No. and 

Type of 

Events 

Crew 

Response 

Crew Response 

Prevention Potential 

Malfunction 

Detection Potential1

11 S 1 LOC 

10 RTO>V1 

1 (9%) With Prevention Potential 

6 (55%) No Prevention Potential2

4 (36%) Unknown Prevention 

Potential 

11 (100%) With 

Detection Potential 

47 I 1 LOC 

7 Other 

25 SDGE 

14 RTO>V1 

13 (28%) With Prevention Potential 

16 (34%) No Prevention Potential2

18 (38%) Unknown Prevention 

Potential 

43 (91%) With 

Detection Potential 

4 (9%) Unknown 

Detection Potential 

1. Does not include, consider, or assess the reliability with which detection could be accomplished. Includes 

three special cases where the relationship between malfunction and CR is questionable, and three 

RTO>V1 events. 

2. Assessments do not include, or rule out, prevention potential from other kinds of interventions.

The 11 S events involved 1 LOC and 10 RTO>V1 events. The 47 I events involved 1 LOC, 7 

Other, 25 SDTGE, and 14 RTO>V1 events. Most of these events are estimated to have detection 

potential. Table 4-32 summarizes the prevention potential by crew response. 

• 67% of the LOC and Other events have prevention potential (6 of 9). 

• 38% of the SDGE events have prevention potential (8 of 21). Note that most of the 

events with prevention potential are events where the shutdown was intentional. Sixtytwo percent (13 of 21) of the SDGE events are known or suspected unintentional 

shutdowns. There is no or indeterminate prevention potential in most of the unintentional 

shutdown events. 

• All the TGE events have malfunction detection potential, but prevention potential is 

indeterminate and is suspected unlikely in all such events. 

• None of the 24 RTO>V1 events can be determined to have prevention potential—58% 

(14 of 24) have no prevention potential, and prevention potential cannot be determined in 

the remaining 42% (10 of 24) of events. 

4-65
TABLE 4-32. ESTIMATED ICR PREVENTION POTENTIAL—AIA REPORT 

S AND I EVENTS 

11 S Events 1 LOC 

1 PP 

0 Other 0 SDTGE 10 RTO>V1 

6 NP, 4 IP 

47 I Events 1 LOC 

1 NP 

7 Other 

5 PP, 2 NP 

21 SDGE 

8 PP, 5 NP, 8 IP 

4 TGE 

4 IP-Unlikely PP 

14 RTO>V1 

8 NP, 6 IP 

PP=Prevention Potential. NP=No Potential. IP=Indeterminate Potential. 

4.2.5.2.3 Post-AIA Report Event Prevention Potential Assessment. 

In the post-AIA report period, 1996-2001, 10 post-AIA report PSM+ICR events were identified: 

2 H, 1 S, and 7 I. The post-AIA report events were evaluated for prevention and detection 

potential. Overall, most events are estimated to have detection potential. Table 4-33 documents 

the potential that malfunction annunciation has to prevent or reduce UCR in these events. 

• 40% of events are estimated to have prevention potential (4 of 10) 

• 30% of events appear to have no prevention potential (3 of 10) 

• Prevention potential could not be determined in the remaining 40% (4 of 10) and was 

therefore listed as unknown. 

The post-AIA report events involved two LOC, four Other, three SDGE, and one RTO>V1. 

Table 4-34 summarizes the prevention potential by crew response. Four events, one LOC, one 

Other, and two SDGE, are estimated to have prevention potential. 

4.2.5.3 Existing Indications, Alerts, and Functions PSM+ICR Prevention Potential. 

Current model aircraft support improved primary flight control awareness and control and 

support improved engine state and malfunction awareness and engine control in several ways. 

Such improved awareness acts to reduce the occurrence and mitigate the hazard of PSM+ICR 

events. The following sections summarize the primary flight control, engine indication, and alert 

annunciation enhancements on current Boeing aircraft. 

4-66
TABLE 4-33. ESTIMATED ICR PREVENTION POTENTIAL—POST-AIA 

REPORT EVENTS 

No. and 

Type of 

Events 

Crew 

Response 

Crew Response 

Prevention Potential 

Malfunction 

Detection Potential*

2 H 1 LOC 

1 Other 

1 (50%) No Prevention Potential 

1 (50%) Unknown Prevention 

Potential 

2 With Detection Potential 

1 S 1 Other 1 (0%) No Prevention Potential 1 With Detection Potential 

7 I 

1 LOC 

2 Other 

3 SDGE 

1 RTO>V1 

4 (57%) With Prevention Potential 

1 (14%) No Prevention Potential 

2 (29%) Unknown Prevention 

Potential 

4 With Detection Potential 

3 Unknown Detection 

Potential 

* Does not include, consider, or assess the reliability with which detection could be accomplished. 

Assessments do not include, or rule out, prevention potential from other kinds of interventions. 

TABLE 4-34. ESTIMATED ICR PREVENTION POTENTIAL—POST-AIA REPORT 

EVENT TYPES 

2 H Events 1 LOC 

NP 

1 Other 

IP 

0 SDTGE 0 RTO>V1 

1 S Events 0 LOC 1 Other 

1 NP 

0 SDTGE 0 RTO>V1 

7 I Events 1 LOC 

PP 

2 Other 

1 PP, 1 IP 

3 SDGE 

2 PP, 1 IP 

1 RTO>V1 

NP 

PP=Prevention Potential. NP=No Potential. IP=Indeterminate Potential. 

4.2.5.3.1 Primary Flight Control Indications, Annunciations, and Alerts. 

In general, the PFDs on modern aircraft provide greater integration of airspeed, attitude, altitude, 

and vertical speed and heading associated operating limits. PFDs also provide information such 

as Mode Control Panel (MCP) targets and Autothrottle and Autopilot modes. The B777 aircraft 

specifically provides: 

• PFD Airspeed Tape amber maneuver and red minimum (stick shaker) speed band 

indications provide full-time awareness of current airspeed relative to maneuver margin 

and stick shaker speeds. 

• An AIRSPEED LOW caution alert to ensure awareness whenever airspeed drops below 

minimum maneuver speed.

• Stall and Overspeed Protection. The aircraft cannot be trimmed to speeds above 

maximum operating speed or below minimum maneuvering speed. Continuous forward 

4-67
column force is required to maintain airspeed above Vmo/Mmo. Continuous aft column

force is required to maintain airspeed below minimum maneuvering speed. 

• A PFD Pitch Limit Indicator (stick shaker pitch attitude) displays continuously flaps 

down and flaps up whenever airspeed drops below minimum maneuver speed. 

• Roll envelope BAP. BAP engages whenever the airplane bank angle exceeds 

approximately 35 degrees. Control wheel forces are applied to roll the airplane back 

within 30 degrees of bank. 

• PFD attitude indications of excessive bank and slip/skid. 

• A BANK ANGLE voice callout is provided whenever the airplane bank angle exceeds 

approximately 35, 40, and 45 degrees. 

• TAC is provided. Whenever engine thrust differs by 10% or more, TAC automatically 

adds rudder to minimize yaw. 

Generally, there is good cross-model coverage for low airspeed indication, pitch limit indication, 

and bank angle voice callout. However, many implementations are recent or optional, e.g., Bank 

Angle Callout became available in the mid 1990s, and speedtape is not the basic indication on 

some models. Not all models alert to low airspeed prior to stick shaker, and only the fly-by-wire 

aircraft have control functions such as BAP and TAC. 

4.2.5.3.2 Engine Indication and Indication Annunciations. 

In general, the EICAS display and other similar systems on current aircraft provide greater 

integration of engine indications, alerts, and airframe system information. Display-based engine 

indications in particular allow enhanced presentation of engine parameters and 

nonnormal/malfunction annunciations. 

As illustrated and discussed in section 2, the B777 aircraft specifically provides: 

• Commanded and actual thrust indications. 

• Grey round dial scale fill. 

• Primary and secondary engine indication annunciations when limits are reached or 

exceeded. 

• Auto display of secondary engine indications when parameter limits or thresholds are 

reached or exceeded.

Generally, there is good cross-model coverage for commanded thrust indication, high EGT, and 

high engine thrust. Not all models provide indication fill, or indication annunciation for engine 

subidle, thrust shortfall, and high vibration. Indication annunciation is not provided for within 

limits overthrust and throttle/thrust splits. 

4-68
4.2.5.3.3 Engine Malfunction EICAS Alerts. 

Crew alerting is the accepted means in the modern flight deck to assure timely crew awareness 

and appropriate crew response. The B777 specifically provides EICAS or other alerting for 

engine failure and thrust shortfall. 

Current aircraft EICAS alert coverage, or equivalent, is provided for engine failure (subidle), but 

it is optional on some models. Some models provide thrust shortfall and throttle/thrust split 

alerting. One model provides surge alerting, otherwise surge alerting is not provided. Engine 

overthrust, overtemperature, high vibration, and thrust asymmetry alerting is not provided. 

Engine Failure (subidle, flameout, etc.), Surge, Stuck Throttle, and Failed Fixed Thrust are 

considered engine malfunctions. These malfunctions are usually the consequence of a physical 

failure or degradation of the engine, a product of the operating environment, or a combination of 

the two. High vibration and thrust asymmetry may or may not be malfunction-related and are, 

therefore, considered symptoms. This differentiation of malfunctions and symptoms is 

somewhat arbitrary and arguable, but it is assumed for discussion purposes. 

4.2.5.3.4 The ICR Prevention Potential—Hull Loss (With and Without Fatalities) Events. 

The ICR prevention potential of modern aircraft primary flight control, engine state, and engine 

malfunction indications, annunciations, and alerts is discussed and assessed in the following 

sections. Prevention potential is assessed by ICR type for those combinations of ICR and 

malfunction type previously identified as having prevention potential. 

LOC events are shown in table 4-30. Hull Loss LOC events are shown to be associated with 

thrust asymmetry, powerloss, and stuck throttle. 

4.2.5.3.4.1 Thrust Asymmetry. 

Thrust asymmetry typically induces yaw that induces roll and possibly pitch changes, which 

affect attitude and may affect airspeed. As noted in the task 2.1 report, the LOC event data 

suggest that airspeed and attitude awareness and control represent the greatest potential for LOC 

prevention and risk mitigation. The task 2.1 report also notes that thrust asymmetry is primarily 

associated with LOC in general, and fatal LOC events in particular. As previously described, 

existing low airspeed indication, pitch limit indication, and bank angle voice callout act to 

address LOC events in general, and the roll and pitch effects associated with thrust asymmetry in 

particular. Further benefit accrues where airspeed low alerts and bank angle and slip/skid 

indications are provided. 

4.2.5.3.4.2 Powerloss. 

Fatal LOC events are associated with powerloss. Therefore, benefit accrues where powerloss 

indications and alerts are provided to ensure crew awareness. As previously described, there is 

complete cross-model indication of powerloss through the commanded thrust indication on the 

4-69
actual thrust indication, but incomplete cross-model indication of engine dial and tape fill, which 

enhances cross comparison of multiengine indications. There is incomplete cross-model 

annunciation of subidle engine failures. There is indication, but no annunciation, of partial or 

complete powerloss on the engine indications. Partial powerloss, i.e., thrust shortfall, is alerted 

on only one model. 

4.2.5.3.4.3 Stuck Throttle (Engine Failed Fixed Thrust). 

Fatal LOC events are associated with stuck throttle—stuck low and stuck high. As discussed, 

the occurrence of stuck throttles on modern aircraft is greatly reduced and has been succeeded by 

Failed Fixed Thrust conditions. Therefore, benefit accrues where indications and alerts are 

provided to ensure crew awareness of conditions where thrust fails fixed and results in thrust 

shortfall or overthrust. These may be identified by throttle splits, thrust splits, and differences in 

commanded and actual thrust. As previously described, there is complete cross-model indication 

of failed fixed thrust through the commanded thrust indication on the actual thrust indication, but 

incomplete cross-model indication of Failed Fixed Thrust through comparison of multiengine 

dial and tape fill. Thrust stuck low, i.e., thrust shortfall, is alerted on only one model. Thrust 

stuck high, i.e., overthrust, is not alerted on any model. 

4.2.5.3.4.4 Surge. 

Surge may accompany LOC powerloss events when powerloss is caused by severe engine 

damage, or powerloss causes rapid engine deceleration. Surges of concern are those that require 

crew action to recover, and those that are nonrecoverable. EGT exceedance and high vibration 

may, or may not, accompany surge. As previously described, there is complete cross-model 

annunciation of high EGT. EGT amber and red exceedance annunciations on the primary 

display are provided on all Boeing models. However, the amber maximum continuous limit 

indication is inhibited for 5 minutes after Takeoff or Go-Around—the phases of flight where 

powerloss-related surge most often results in LOC. Cross-model annunciation of High 

Vibration, and auto display of the secondary engine vibration indication, is incomplete. There 

are no Surge or High Vibration alerts on most models, and the only existing surge alert is 

inhibited in the phases of flight where powerloss-related Surge LOC events have occurred. 

SDTGE events are shown in tables 4-28, 4-29, and 4-30. Both fatal and nonfatal Hull Loss 

SDTGE events are shown to be associated with surge. Surges of concern are those that require 

crew action to recover, and those that are nonrecoverable. EGT exceedance and high vibration 

may, or may not, accompany surge. As previously described, there is complete cross-model 

annunciation of high EGT. Amber and red EGT exceedance annunciations on the primary 

display are provided on all Boeing models. However, the maximum continuous limit indication 

is inhibited for 5 minutes after Takeoff or Go-Around. TGE events are typically nonfatal and 

usually occur in early Takeoff Climb. SDGE events usually occur in late Climb, Cruise, 

Descent, and Approach phases of flight where the EGT indication can provide crew awareness. 

The one existing Surge alert provides crew awareness and supports crew response. There are no 

Surge or High Vibration alerts on most models. In addition, cross-model annunciation of high 

vibration, and auto display of the secondary engine vibration indication, is incomplete. 

4-70
Other (O) events are shown in tables 4-28, 4-29, and 4-30. Hull Loss with both fatalities and 

without fatalities Other events are shown to be associated with surge. These events typically fail 

to execute or complete the correct procedure. Surge typically involves failure to reduce power 

on the surging engine, which usually leads to eventual engine failure. In general, a specific alert 

annunciation must be provided to ensure the crew accomplishes a specific procedure. Surge 

alert on one model provides crew awareness and guides crew response. However, there are no 

Surge alerts on most models. 

RTO>V1 events are shown in tables 4-28, 4-29, and 4-30. Hull Loss without fatalities RTO>V1 

events are shown to be associated with powerloss. See LOC powerloss discussion of powerlossrelated indications, indication annunciations, and alerts in section 3.7. 

High vibration posed unique issues with respect to PSM+ICR. Correlation between vibration 

and PSM+ICR is indeterminate/unclear. Vibration may or may not accompany powerloss, surge, 

and other engine malfunctions. Of the 23 Hull Loss events, only 2 specifically cite severe or 

high vibration in the PSM+ICR event data. Both events (no. 46 H (with no prevention potential) 

and no. 53 HF (with prevention potential)) involved surge. In the H case, the crew reported 

lateral airframe vibrations so severe the engine indications were unreadable. The HF case, a 

surge event involving SDGE and later powerloss and failure of the affected engine involved high 

vibration on the affected engine even after it was reduced to idle power. In this case, an explicit 

High-Vibration annunciation might have redirected the crew’s attention to the affected engine. 

Note that vibration is known to be present in HF event 77 (with prevention potential). But the 

degree and character of vibration is indeterminate in terms of its detection and annunciation 

potential and utility. 

Finally, vibration may exist but not be associated with an engine malfunction or a significant 

safety condition. Vibration detection/sensing is susceptible to error. Engine vibration operating 

limits are not specified for most engines. Therefore, while vibration may be a corroborating 

indication, it cannot be relied solely upon to be present or meaningful. 

4.2.5.3.4.5 Summary and Conclusions. 

Powerloss (Thrust Shortfall and Engine Fail Low), Surge, Stuck Throttle, High Vibration, and 

Thrust Asymmetry are the engine malfunctions and symptoms associated with fatal and other 

type events in the AIA report. These malfunctions, or their equivalents, are also significant 

occurrences in the task 2.1 report 2000 and 2001 PSM data and are associated with post-AIA 

report PSM+ICR events. 

ICR prevention potential through malfunction annunciation exists in 50% or more of fatal 

events. Fatal events with prevention potential account for 88% of all PSM+ICR fatalities. 

Prevention potential also exists in Hull Loss, Substantial Damage, and Incidental ICR events. 

Most prevention potential exists in the area of LOC, followed by Other and Shutdown or 

Throttled Good Engine. Least prevention potential exists in the area of RTO>V1. 

Most prevention potential is associated with Powerloss and Surge, followed by Failed Fixed 

Thrust malfunctions. 

4-71
The majority of these malfunctions appear to be detectable. Detection potential appears to exist 

in all cases where prevention potential is identified. The principal detection issue is reliable and 

meaningful detection, particularly in the case of surge and vibration. 

The lack or presence of PSM annunciation could favorably affect the likelihood of timely crew 

awareness and could, thus, decrease the likelihood of ICR. Low airspeed and pitch limit 

indications and annunciations and bank angle voice callout reduce the likelihood of LOC events 

with prevention potential, but do not address the SDTGE, Other, and RTO>V1 events with 

prevention potential. 

4.2.6 Desired/Required Crew Awareness and Response—Potential Annunciations. 

The first step in assessing the operational value of a potential annunciation is definition of 

desired crew awareness/understanding and response. In general, the crew should be made aware 

• that a propulsion system malfunction or symptom exists. 

• of the specific engine affected. 

• of the specific type or nature of the propulsion system malfunction or symptom, and the 

manner and extent of its affect on the engine. 

The crew should/must understand the operational implications of the PSM and its potential affect 

on subsequent near- and long-term operations and continued safe flight and landing. 

In general, awareness and understanding help ensure appropriate crew response and should lead 

directly/unambiguously to a specific nonnormal procedure. It is expected per basic airmanship, 

not per published procedure, that the initial response to any engine malfunction must be to fly 

the airplane, e.g., control airspeed, attitude, and flight path, not diagnose engine problems. After 

establishing/ensuring basic airplane control, the following generalized actions are typical for the 

following engine malfunctions and symptoms. Note that actual procedures may vary from

aircraft to aircraft and are often situational-dependent. 

• Engine Fail (unresponsive to throttle) 

• Engine Fail (subidle). Control or correct thrust asymmetry. Attempt engine restart or 

shutdown engine. 

• Thrust Shortfall. Control or correct thrust asymmetry. 

• Engine Failed Fixed Thrust (thrust shortfall or overthrust). Control or correct thrust 

asymmetry. Attempt recovery of normal engine function. 

• Engine Fail High Thrust (overthrust). Control or correct thrust asymmetry. When phase 

of flight circumstances and operating procedures allow, reduce thrust to within limits, use 

or shutdown the engine. 

4-72
• Engine Surge. When phase of flight operating procedures allow (e.g., above safe 

altitude), reduce power on the affected engine until surging stops or idle is reached. If 

surging continues at idle, the engine may be shutdown. 

• High Engine Vibration. When phase of flight operating procedures allow (e.g., above 

safe altitude), reduce power on the affected engine until vibration returns to acceptable 

levels or idle is reached. Note: Engine vibration may be used in conjunction with other 

indications or annunciations to corroborate engine malfunction and identify affected 

engine. 

• Thrust Asymmetry. Maintain airspeed and attitude control. Identify and disposition the 

root cause problem. 

4.2.6.1 Potential Safety and Operational Benefits and Risks. 

The potential benefits associated with detection and annunciation of Powerloss, Surge, Engine 

Fail Low/Fixed/High Thrust, High Vibration, and Thrust Asymmetry have been documented in 

previous sections. Table 4-16 summarized these benefits in terms of value (safety potential), 

effectiveness (crew response prevention potential), and potential risk. 

Potential benefits are based on the assumption of reliable detection and annunciation. Reliable 

implies consistent and meaningful detection and annunciation. The general benefit of 

annunciation is that it ensures appropriate crew awareness and response. Crews are not 

misdirected into falsely believing some other condition or malfunction occurred and taking 

inappropriate or unnecessary action. 

Potential risk is assessed based on (1) the risk associated with annunciation in general, (2) the 

risk associated with false or nuisance annunciation, and (3) the risk associated with failure to 

annunciate when the crew knows an annunciation exists and may be relying on its presence or 

absence. 

4.2.6.1.1 General Risks Applicable to All Malfunctions. 

• Distraction During High Crew Workload Flight Phase. The risk associated with 

annunciation (indication or alert) in general, regardless of whether the annunciation is 

true or false, relates to UCR from the annunciation itself, not the malfunction being 

annunciated. This is primarily a concern in flight phases where the crew does not have 

time to assess the indication or alert, e.g., during takeoff above V1 or on short final 

approach and flare. Anything designed to attract crew attention, risks crew distraction 

and UCR. Typically, in Takeoff and Approach phases, annunciations are temporarily 

inhibited where the risk of delaying annunciation is far outweighed by the risk of ICR 

such as RTO>V1 or low altitude go-around. Additionally, risk varies within range/limits 

versus out of range/limits malfunction annunciations. There is lower risk associated with 

annunciation of out-of-limit (high or low) parameters and more risk of nuisance 

associated with detecting nonnormal conditions within normal parameter range. 

4-73
• False Annunciation. The immediate risk of false annunciation is (a) unnecessary 

distraction and (b) erroneous crew awareness, understanding, and response. The crew 

may be distracted from accomplishing important tasks, may become confused by 

noncorroborating or conflicting indications, or may take action that unnecessarily affects 

airplane operation or capability. The longer-term risk of repeated false annunciation is 

the potential loss of alert and alerting system credibility and possible crew failure to 

respond when required. If a false alert occurs repeatedly, the crew can quickly become

desensitized to the alert and ignore or otherwise fail to respond to the alert when valid. 

The crew may also begin to question other valid alerts. In all cases, crew workload and 

error potential are unnecessarily and undesirably increased. The acceptability of false 

annunciation is proportional to the criticality of the condition and crew response. 

• Failure to Annunciate/Detect. The risk associated with failure to annunciate when the 

crew knows an annunciation exists, and may be relying on its presence or absence, is 

primarily that crew response may not occur, or may occur too late. In the absence of an 

alert, detection/awareness and interpretation/understanding is more difficult and errorprone. In the absence of an alert, and particularly when little time is available for 

evaluation, there is the general increased risk that crew response may be erroneous or 

inappropriate. 

4.2.6.1.2 Malfunction Annunciation Benefits and Risks Discussion. 

Powerloss (Engine Fail Subidle/Flameout or Thrust Shortfall) can be annunciated (indicated 

and/or alerted) as an Engine x Fail Low (e.g., flameout or subidle), or as an Engine x Thrust 

Shortfall (e.g., actual and commanded thrust disagree). 

4.2.6.1.2.1 Benefits of Powerloss Annunciation. 

As tables 4-28, 4-29, and 4-30 showed, the potential benefit of Powerloss annunciation accrues 

to LOC and RTO>V1 events. Annunciation would provide crew awareness of a powerloss on 

one or more engines. It is expected that such awareness would prompt the crew to assess the 

powerloss impact on flight operations and subsequently respond in an appropriate manner that 

ensures continued safe flight and operation. This response should involve controlling any 

associated thrust asymmetry that might result; acting to safely configure, restore, or secure the 

affected engine(s); and re-evaluating the flight plan. 

4.2.6.1.2.2 Risks Associated With False Detection and Annunciation of Powerloss. 

The RTO>V1 risk from annunciation during takeoff roll has been discussed. False detection and 

annunciation of powerloss during takeoff roll below V1 could prompt an unnecessary RTO and 

inappropriate crew concern for asymmetric reverse thrust. The AIA report LOC events generally 

occurred in high workload phases of flight, e.g., Approach/Go-Around or Takeoff Climb. False 

or nuisance alerting of powerloss during approach might prompt the crew to change aircraft 

configuration or might delay or otherwise affect a go-around decision. False or nuisance alerting 

of powerloss during Takeoff Climb might prompt the crew to change aircraft configuration or 

prompt an unnecessary air turn back. In both cases, workload would unnecessarily increase and 

4-74
crew distraction could delay, prevent, or otherwise affect proper aircraft configuration or 

accomplishment of other flight phase-related tasks. 

4.2.6.1.2.3 Risks Associated With Failure to Detect and Annunciate. 

Failure to detect and annunciate a powerloss on approach risks the crew being unaware that goaround capability and performance are affected. Failure to detect and annunciate a powerloss on 

takeoff may risk the crew being unaware that takeoff and climb capability and performance are 

affected. Both cases can lead to LOC. 

Surge can be annunciated (indicated and/or alerted) as an Engine x Surge. 

4.2.6.1.2.4 Benefits of Surge Annunciation. 

As tables 4-28, 4-29, and 4-30 showed, the potential benefit of Surge annunciation accrues to 

LOC, Other, and SDGE events. Annunciation would provide crew awareness of a surge on one 

or more engines. For surge that automatically recovers, it is expected that awareness will ensure 

the crew is not misdirected into falsely believing some other condition or malfunction occurred 

and taking inappropriate or unnecessary action. For surge that does not automatically recover, 

the annunciation would direct the crew to the appropriate checklist procedure, prompt the crew 

to reduce power on the affected engine(s), and subsequently respond in an appropriate manner 

that ensures continued safe flight and operation. This response should involve controlling any 

thrust asymmetry that might result; acting to safely configure, restore, or secure the affected 

engine(s); and re-evaluating the flight plan. Engine-specific annunciation of surge could prevent 

SDGE events and the procedural errors frequently associated with PSM+ICR events in the Other 

category. 

4.2.6.1.2.5 Risks Associated With False Detection and Annunciation of Surge. 

False detection and annunciation of surge during takeoff roll below V1 could prompt an 

unnecessary RTO, or prompt the crew to inappropriately reduce power below safe altitude. 

False detection and annunciation of surge during Takeoff Climb, Cruise, or Descent could 

prompt an unnecessary thrust reduction or engine shutdown. False or nuisance alerting of surge 

during Approach might prompt the crew to change aircraft configuration or might delay or 

otherwise affect a go-around decision. In all in-flight cases, workload would unnecessarily 

increase and crew distraction could delay, prevent, or otherwise affect proper aircraft 

configuration or accomplishment of other flight phase-related tasks. 

4.2.6.1.2.6 Risks Associated With Failure to Detect Surge. 

Failure to detect and annunciate a surge on Approach risks the crew being unaware that goaround capability and performance may be affected. This can lead to LOC. Failure to detect and 

annunciate a surge on takeoff may risk the crew being unaware that takeoff and climb capability 

and performance are affected. Additionally, in the absence of an explicit annunciation, the crew 

may take inappropriate action such as SDGE, or the loud bangs and vibration that typically 

accompany engine surge may misdirect the crew to believe that some other condition exists. 

4-75
Engine Failed Fixed Thrust (Thrust Shortfall or Overthrust) can be annunciated (indicated and/or 

alerted) as an Engine x Failed Fixed Thrust (no thrust response to throttle/commanded power). 

The special case of Failed Fixed Thrust due to a stuck throttle can be annunciated (indicated 

and/or alerted) as an Engine x Failed Fixed Thrust (no throttle response to command), Throttle 

Split, Thrust Split, Autothrottle Disconnect, or Autothrottle x Fail. 

4.2.6.1.2.7 Benefits of Stuck Throttle Annunciation. 

As tables 4-28, 4-29, and 4-30 showed, the potential benefit of stuck throttle annunciation 

accrues to LOC events. The AIA report Stuck Throttle events involved autothrottle engagement. 

AIA report Stuck Throttle events in general, and the HF events in particular, appear to involve 

sufficient time and opportunity for earlier crew intervention had the stuck throttle been 

annunciated or otherwise called to the crew’s attention near the time it stuck. 

However, the post-AIA report data contained UCR to Engine Failed Fixed Thrust events. 

Engine Failed Fixed Thrust events are more difficult to detect because they do not involve 

throttle split and must instead be detected by a difference in commanded and actual thrust—

either by correlation of throttle position and engine thrust, indication of commanded versus 

actual thrust, or alert annunciation. In the post-AIA report events, benefit accrues to SDGE 

events where commanded thrust was less than actual thrust and the crew misinterpreted the 

low/good engine as failed. 

Annunciation of a Failed Fixed Thrust PSM would provide crew awareness of an engine thrust 

malfunction on one or more engines and of actual or potential thrust asymmetry. It is expected 

that awareness would ensure the crew maintains airplane airspeed and attitude control and 

focuses attention on the correct (i.e., malfunctioning) engine. The annunciation would direct the 

crew to the appropriate checklist procedure, prompt the crew to control power on the affected 

engine(s), and subsequently respond in an appropriate manner that ensures continued safe flight 

and operation. This response should involve controlling any thrust asymmetry that might result; 

acting to safely configure, restore, or secure the affected engine(s): and re-evaluating the flight 

plan. Engine specific annunciation of surge could prevent LOC and SDGE events. 

4.2.6.1.2.8 Risks Associated With False Detection and Annunciation of Engine Failed Fixed 

Thrust. 

False detection and annunciation of engine Failed Fixed Thrust during takeoff roll below V1 

could prompt an unnecessary RTO. False detection and annunciation during Takeoff Climb is 

unlikely until first thrust reduction. At thrust reduction, in Cruise and in Descent, a false alert 

could lead the crew to accomplish an unnecessary procedure and might prompt the crew to 

shutdown a good engine. False or nuisance alerting during Approach might prompt the crew to 

unnecessarily go-around or shutdown a good engine. In all in-flight cases, the workload would 

unnecessarily increase and crew distraction could delay, prevent, or otherwise affect proper 

aircraft configuration or accomplishment of other flight phase-related tasks. 

Note that the most likely false annunciation would be a normal temporary transient difference in 

commanded and actual, versus a persistent or false difference. Such normal nuisance transients 

4-76
could be distracting and disruptive of normal flight operations, and it is possible they could occur 

in unusual unanticipated circumstances where such distraction is undesirable. 

4.2.6.1.2.9 Risks Associated With Failure to Detect Engine Failed Fixed Thrust. 

Failure to detect and annunciate engine Failed Fixed Thrust, risks the crew being unaware that a 

difference in commanded and actual thrust exists. This is typically a difficult condition for 

crews to accurately diagnose, particularly in time-critical situations, and could result in the 

shutdown of the good/unaffected engine, or combined with crew failure to maintain airspeed and 

attitude control, could lead to LOC. 

High Vibration can be annunciated (indicated and alerted) as an indication annunciation, an auto 

display of vibration indication, and as an alert annunciation. 

Correlation between vibration and PSM+ICR is indeterminate/unclear. Vibration may or may 

not accompany Powerloss, Surge, and other engine malfunctions. Of the 23 AIA report Hull 

Loss events, only two specifically cite severe or high vibration in the PSM+ICR event data. 

Both events (no. 46 H (estimated no prevention potential) and no. 53 HF (estimated with 

prevention potential)) involved surge. In event no. 46, the crew reported lateral airframe

vibrations so severe that the engine indications were unreadable. 

Finally, vibration may exist but not be associated with an engine malfunction. Vibration 

detection/sensing is susceptible to error. Engine vibration operating limits are not specified for 

most engines. Therefore, while vibration may be a corroborating indication, in general, it cannot 

be relied upon to be present or meaningful. 

4.2.6.1.2.10 Benefits of High Vibration. 

As tables 4-28, 4-29, and 4-30 show, vibration is not listed as the primary PSM or symptom in 

any HF or H events. Where severe or excessively high vibration is identified as the primary 

PSM or symptom in the AIA report data, the events are incidental. However, vibration is known 

to be present in at least ten PSM+ICR events—two of which are hull loss with fatalities. 

Powerloss and Surge events may involve high vibration. For example, the AIA report HF Surge 

event involving Shutdown of Good Engine, involved high vibration on the affected engine even 

after it was reduced to idle power. In this case, an explicit High Vibration annunciation might 

have redirected crew attention to the affected engine. Otherwise, the benefit of High Vibration 

may be primarily in using it with other indications. 

4.2.6.1.2.11 Risks Associated With False Detection and Annunciation of High Vibration. 

False detection and annunciation of high vibration during takeoff roll below V1 could prompt an 

unnecessary RTO. False detection and annunciation of high vibration during takeoff climb, 

cruise, or descent could prompt an unnecessary thrust reduction, engine shutdown, diversion, or 

air turn back. 

False or nuisance alerting of high vibration during approach might prompt the crew to change 

aircraft configuration or might delay or otherwise affect a go-around decision. In all in-flight 

4-77
cases, workload would unnecessarily increase and crew distraction could delay, prevent, or 

otherwise affect proper aircraft configuration or accomplishment of other flight phase related 

tasks. 

4.2.6.1.2.12 Risks Associated With Failure to Detect High Vibration. 

Failure to detect and annunciate high vibration entails little more risk than the current lack of 

existing annunciation. As previously noted, where severe or excessive vibration is identified as 

the primary PSM or symptom, the events are incidental. In the absence of an explicit 

annunciation, the crew may not identify the high vibration as engine-related, and may be 

misdirected to take other inappropriate action based on whatever condition they believe to be 

causing the vibration. 

4.2.6.1.2.13 Thrust Asymmetry. 

Thrust Asymmetry is an airplane-level effect, not a PSM. Thrust Asymmetry may, or may not, 

be due to a PSM. 

When due to a PSM, Thrust Asymmetry is consequential and circumstantial in that it is a 

potential, but not certain, result of a PSM affecting thrust. Depending on the circumstances, 

thrust asymmetry can follow the PSM quickly, slowly, or not at all. The malfunctions 

responsible for thrust asymmetry can, and often do, occur well in advance of a thrust asymmetry. 

The thrust asymmetries of concern are unintentional, can be characterized as a throttle or thrust 

split, or as a difference between desired or commanded thrust (resulting in either overthrust or 

thrust shortfall on the affected engine), and are a symptom/consequence of a PSM. The PSMs 

with potential to cause thrust asymmetry are Engine Fail Low/Powerloss, Engine Fail 

High/Runaway, Engine Failed Fixed Thrust (where commanded and actual thrust differ), Stuck 

Throttle, and Surge with Powerloss. Thrust asymmetry can result from rapid powerloss events, 

slow powerloss events, engine failure to respond to commanded thrust, and stuck throttle. 

Thrust asymmetry is a contributing factor in many LOC events. However, as previously noted, 

loss of airplane control is primarily due to failure to control airspeed and/or attitude. Most LOC 

events are low-altitude, high-power events involving takeoff, climb, or go-around climb power. 

Most LOC events also involve nonrecoverable malfunctions or involve recoverable malfunctions 

with insufficient time and altitude to attempt or complete engine recovery. Therefore, in most 

PSM situations, thrust asymmetry is unavoidable, and the primary crew objective is to control, 

not correct, the thrust asymmetry. 

General alert philosophy is to ensure timely crew awareness of nonnormal conditions, which 

require crew awareness and response. In practice, alerts are provided at the earliest or most 

appropriate point. The alert is used to focus crew attention on the nonnormal condition, which 

best ensures appropriate crew awareness and response. The consequences of engine thrust 

malfunction are well trained and well understood. Once the crew is aware of an engine 

malfunction, awareness of thrust asymmetry, or the potential for thrust asymmetry, is expected to 

immediately follow, particularly if the malfunction is thrust-related. It is best left to the flight 

crew to put their awareness of an engine malfunction into the proper context of the current phase 

of flight and other existing relevant circumstances. 

4-78
Engine indication or alert annunciation of thrust asymmetry is problematic in that Thrust 

Asymmetry may, or may not, be due to a PSM. In addition, Thrust Asymmetry is nonspecific 

and does not aid the crew in determining which engine is malfunctioning or why the engine is 

malfunctioning. There are sufficient potential risks associated with Thrust Asymmetry 

annunciation (including nuisance alerts) to outweigh the potential benefit. Additionally, there 

are easier and more effective means of addressing the problems caused by thrust asymmetry 

(e.g., LOC). Thrust asymmetry occurs as the result of a significant thrust shortfall or overthrust. 

Of the PSMs that underlie significant thrust asymmetry, all except stuck throttle can be sensed as 

thrust shortfall or overthrust. Stuck throttle is a concern only when it occurs with autopilot 

engaged. There are no autothrottle or autoflight control laws that use split throttle or differential 

thrust. Therefore, split throttle/thrust is reliably detectable if the throttle lever position or engine 

thrust is known/sensed and compared. 

The goal of any Thrust Asymmetry indication or annunciation should be to make consequential 

thrust asymmetry intuitively obvious at the airplane level versus the engine system level. Thrust 

Asymmetry may be best indicated to the crew on the Primary Flight Display where its effects for 

most PSM events must generally be addressed through airplane-level control. 

4.2.6.1.2.14 Stuck Throttle. 

The reported incidences of stuck throttle on modern aircraft in general, and on current Boeing 

production aircraft in particular, are much lower than on older aircraft. This is attributed to 

differences in autothrottle mechanism design between current and older generation aircraft. For 

example, differences in autothrottle mechanism design are estimated to reduce the incidence of

stuck throttle by two orders of magnitude—from approximately 200 events per year to about 1 

event every 2 years. 

4.2.6.1.3 Summary of Annunciation Benefits and Risks. 

Table 4-35 summarizes an assessment/estimate of the Safety Potential (Benefit), ICR Prevention 

Potential, and Potential Operational Risks associated with a new engine indication annunciation 

or alert annunciation for the malfunctions and symptoms listed. 

• Potential Safety Benefit is the estimated potential the annunciation has to prevent 

PSM+ICR events in general, and fatal and Hull Loss events in particular. This estimate 

is based primarily on task 2.1 data analysis of the number of fatalities and events the 

annunciation has the potential to prevent. 

• ICR Prevention Potential is the estimated effectiveness of an engine indication 

annunciation and/or an alert annunciation to provide a level of crew awareness and 

understanding sufficient to prevent ICR to the PSM. This estimate is based primarily on 

PSM+ICR event data review and analysis. 

• Potential Operational Safety Risk is the estimated operational safety risk associated with 

the annunciation. This estimate is based primarily on the preceding risk benefit 

discussions. 

4-79
TABLE 4-35. POTENTIAL BENEFIT, EFFECTIVENESS, AND RISK OF NEW

ANNUNCIATION/ALERT 

Malfunction or Symptom

Potential Safety 

Benefit 

ICR Prevention 

Potential 

Potential 

Operational Safety 

Risk 

Engine Failure (subidle/flameout) H H L3

Engine Failed Fixed Thrust H H L4

Engine Surge H H L-M5

High Vibration1 L-M1 M1 L5

Thrust Asymmetry

2 I2 L I2

H=High. M=Medium. L=Low. I=Indeterminate. 

1. See Vibration discussion. 

2. See Thrust Asymmetry discussion. 

3. Based on existing B777 engine failure alerting. 

4. Based on existing B777 thrust shortfall alerting. 

5. Operational risk is a function of annunciation threshold and detection reliability, i.e., probability of false 

alerting. 

Table 4-36 shows task 2.1 report PSM data on surge recoverability. Overall, recoverability can 

be estimated in about 87% of the events. Where recoverability can be estimated, about half the 

events are recoverable and half are nonrecoverable. Of the recoverable events, one-third recover 

without crew action and two-thirds require crew action to recover. So most Surge events are 

either nonrecoverable or require crew action to recover. 

TABLE 4-36. TASK 2.1 REPORT PSM SURGE EVENT DATA 

Surge Type 

(R versus NR) 

Number of 

Occurrences 

Percent of 

Total 

Nonrecoverable 98 43.2

Recoverable—Crew Action 69 30.4 

Recoverable—No Crew Action 31 13.7 

Recoverability Unknown 29 12.8 

Total 227

 Recoverable—Crew Action: No IFSD 55 79.7 

 Recoverable—Crew Action: IFSD 14 20.3 

In general, table 4-37 shows that where recoverability can be determined, a majority of the AIA

report PSM+ICR Surge events, and about half of the 2000-2001 PSM Surge events, involve 

nonrecoverable surge. The AIA report data indicate that Hull Loss Surge events in particular, 

predominately involve nonrecoverable surge. 

4-80
TABLE 4-37. THE AIA REPORT PSM+ICR AND 2000-2001 SURGE EVENT DATA 

Recoverable Nonrecoverable Unknown

RTO, SDTGE, and Other AIA 

Report Surge Events 

27% (10 of 37) 51% (19 of 37) 22% (8 of 37) 

2000-2001 PSM Surge Events 44% (100 of 227) 43% (98 of 227) 13% (29 of 227) 

The potential operational safety benefit in differentiating recoverable and nonrecoverable PSMs 

in general, and Surge in particular, is that the nonrecoverable malfunctions are usually associated 

with fatal hull loss events. Self-recoverable surges are of much lesser, if of any, concern and 

therefore annunciation of them is of minimal value. 

In addition, as table 4-36 shows, IFSD data analysis indicates that there may be potential to 

reduce the number of IFSDs associated with Surge events requiring crew action to recover. 

Based on AIA report event data and estimates of prevention potential, Surge annunciation should 

focus on annunciation of nonrecoverable and recoverable with crew action Surge events. Fatal 

and nonfatal Hull Loss event data indicate that Surge annunciation could be useful for persistent 

continuous Surge events requiring crew action to recover or mitigate effects of nonrecoverable 

surge. To be useful in ICR prevention, such annunciations do not require immediate detection 

and annunciation. Based on AIA report event data and estimates of prevention potential, a 10- to 

15-second delay in Surge annunciation would still allow an operationally acceptable, useful, and 

effective annunciation. An annunciation that a recoverable surge has occurred has little safety 

value.

4.2.6.2 Summary, Conclusions, and Preliminary Recommendations. 

4.2.6.2.1 Summary. 

The AIA report shows that PSM+ICR events are not limited to Boeing aircraft. No attempt was 

made to obtain or analyze data for other aircraft manufacturers. Boeing aircraft data is cited in 

this report primarily because it was readily available to the Boeing investigators involved. 

Report analyses focused on Boeing Flight Decks primarily because the Boeing investigators 

involved have ready access to and expertise in the Boeing Design and Operational Philosophies 

and Flight Deck implementations. 

Powerloss, Surge, and Stuck Throttle account for all fatal PSM+ICR events and most other 

PSM+ICR events. These malfunctions, or their equivalents, are major contributors in the 2000-

2001 PSM data and the post-AIA report PSM+ICR events. 

ICR prevention potential through malfunction annunciation exists in 50% or more of fatal 

events. Fatal events with prevention potential account for 88% of all PSM+ICR fatalities. 

Prevention potential also exists in Hull Loss, Substantial Damage, and Incidental ICR events. 

4-81
Fifty percent of fatal, 36% of nonfatal Hull Loss, and 24% of other AIA report PSM+ICR events 

were assessed to have prevention potential. Prevention potential, or lack of, could not be 

determined in 42% of fatal, 9% of nonfatal, and 38% of other PSM+ICR events. Post-AIA 

report PSM+ICR events have similar or higher overall prevention potentials. 

Most prevention potential exists in the area of LOC, followed by Other and Shutdown or TGE. 

The least prevention potential exists in the area of RTO>V1. 

• PSM annunciations offer prevention potential for fatal LOC, SDTGE, and Other ICR 

category events. 

• PSM annunciations offer little or no prevention potential for fatal RTO>V1 events. PSM 

annunciation above V1 during takeoff risks causing RTO>V1 events. 

• For nonfatal Hull Loss events, PSM annunciations offer prevention potential in all ICR 

categories. 

Most prevention potential is associated with Powerloss and Surge, followed by Failed Fixed 

Thrust malfunctions. The majority of these malfunctions appear to be detectable. The principal 

detection issue is reliable and meaningful detection, particularly in the case of surge. 

Prevention potential is the estimated opportunity, through PSM annunciation, to prevent or 

mitigate ICR by providing timely awareness, correct understanding, and linkage to the 

appropriate nonnormal procedure. In all cases where prevention potential has been judged to 

exist, it is meant only to mean the event might have been prevented. Note that the prevention 

potential assessment herein focused only on the prevention potential PSM annunciation. PSM 

annunciation may not be the only, or necessarily be the most effective means of reducing the 

PSM+ICR rate or obtaining desired crew response. There may be other equally or more 

effective, or more feasible, means to address PSM-related ICR. 

Between 1958 to 2001 there have been 12 HF and 13 H PSM+ICR events in the commercial 

transport turbojet fleet over approximately 396 million flights. The modern glass cockpit 

FADEC-powered fleet (aircraft designed and certified in the 1980s and later) have 

approximately 43 million flights and no PSM+ICR-related H or HF events. 

Per task 2.1 report analysis of AIA report events, the expected frequency of a PSM+ICR event of 

• any type (HF, H, S, or I) is rare, 2.6E-07 per flight—one event in every 3.8 million 

flights. 

• a Hull Loss (HF or H) is more rare, 7.5E-08 per flight—one event in every 13.3 million 

flights. 

• a fatal PSM+ICR event is very rare, 3.9E-08 per flight—one event in every 25.7 million 

flights. 

4-82
PSM+ICR rates, when calculated for combined AIA report and post-AIA report events, are only 

slightly improved over those cited here for AIA report events. 

Many enhancements to airspeed and attitude awareness, engine indications, and PSM 

annunciations have been implemented on current aircraft models. But not all enhancements have 

been implemented on all aircraft models or all aircraft. Cross-model malfunction annunciation 

of Engine Failure (subidle), Engine Surge, and Engine Failed Fixed Thrust (Thrust Shortfall and 

Overthrust) malfunctions is generally incomplete. 

4.2.6.2.2 Conclusions. 

Based on the Boeing study, Flight Deck annunciation of the following PSMs could provide a 

potential safety benefit. 

• Engine Failure (subidle) 

• Engine Thrust Shortfall 

• Engine Surge 

• Engine Overthrust 

Careful implementation of these PSM annunciations (i.e., how/where implemented and when 

provided) is crucial to effectiveness. Implementations must accommodate diverse engine and 

airframe designs and operational philosophies. And the factors that have limited previous 

implementation must be considered and addressed. 

A feasibility assessment for High Vibration and Stuck Throttle is required before implementation 

recommendations can be made. 

Lack of annunciation of Engine Failure (subidle), Thrust Shortfall, Overthrust, Surge and High 

Vibration can affect the likelihood of timely crew awareness and/or understanding of engine 

malfunction and may thereby decrease the likelihood of appropriate crew response. 

Low airspeed and pitch limit indications, bank angle voice callout, low airspeed alert, and other 

airspeed and attitude awareness and control enhancements should reduce the likelihood of LOC 

events, but they do not address the Shutdown/Throttled Good Engine, Other, and RTO>V1 

events. 

Current production aircraft incorporate many engine indication enhancements, PSM 

annunciations (indications and alerts), and non-PSM indications, annunciations and alerts, which 

act to reduce the risk and hazard associated of PSM+ICR. All other factors being equal, this 

should reduce the rate of HF and H PSM+ICR events on these aircraft. However, an assessment 

of all other factors has not been made, and the overall effect of other factors, such as pilot 

experience, training, engine reliability, and fleet maturity, is therefore not known. 

Overall analysis of historical and current PSMs and PSM+ICR events and rates, current aircraft 

enhancements, and miscellaneous qualitative assessments suggests that the future PSM+ICR 

rates on current production aircraft should be improved. But the degree of improvement cannot 

be determined. In the absence of additional preventative factors, it is possible for potentially 

4-83
preventable PSM+ICR events in general, and HF and H PSM+ICR events in particular, to occur 

as the current fleet accumulates additional flights. 

Potential operational safety benefit exists for Engine Failure (subidle), Engine Thrust Shortfall 

and Overthrust, and Engine Surge Malfunction annunciations (indications and/or alerts). The 

benefit varies per crew response (LOC, O, SDGE, RTO>V1). 

Engine Failure (subidle), Engine Thrust Shortfall and Overthrust, and Engine Surge malfunction 

annunciations have the collective potential to reduce the HF PSM+ICR rate by as much as a 

factor of two or more and have the potential to also reduce H, S, and I PSM+ICR rates. Order of 

magnitude improvements are not possible because of the low number of PSM+ICR event 

occurrences. 

Thrust Asymmetry annunciation potential benefit and effectiveness is indeterminate and has 

potential risk. 

PSM annunciations above V1 during takeoff have the potential to increase the RTO>V1 rate. 

The challenge is to change inappropriate human behavior to affect the outcome in one of several 

million flights without negatively changing or affecting the outcome in all the remaining several 

million flights, less the one of interest. 

Some open issues need to be discussed: 

• 

• 

• 

The feasibility of implementing new PSM annunciations must be assessed prior to any 

implementation commitment. Feasibility must be assessed for production, retrofit, and 

new/future airplanes. 

Any new malfunction annunciations must be developed/refined, tested, and validated 

prior to implementation. Testing and validation should include assessment of the 

effectiveness of annunciation to prevent, reduce, or mitigate PSM+ICR events. 

Reliable detection of meaningful Surge must still be demonstrated, tested, and validated 

before a Surge annunciation can be implemented. 

4.2.6.2.3 Preliminary Recommendations. 

It is recommended that the following PSMs should be assessed for feasibility of Flight Deck 

annunciation: 

• Engine Failure (subidle) 

• Engine Thrust Shortfall 

• Engine Surge 

• Engine Overthrust 

4-84
Feasibility should be assessed for production, retrofit, and new/future airplanes. Feasibility 

assessment should include, but not be limited to, CAST analysis. Feasibility should include a 

relative assessment of malfunction annunciation versus other interventions such as CRM and 

malfunction training, airspeed and attitude awareness enhancements, flight control protection, 

and compensation functions. Crew training, development of SOPs, policy development or safety 

culture may be more feasible interventions than onboard hardware or software changes for the 

current fleet. 

• Recommend the FAA sponsor and support: 

− follow-on research to demonstrate/validate reliable surge detection and to refine 

and validate specific PSM annunciations. 

− engine manufacturer, airframe manufacturer, and airline collaboration on PSM 

annunciation feasibility assessments, implementation requirements, and validation 

activities. 

• Do not recommend Thrust Asymmetry, Stuck Throttle, and High Vibration annunciation 

without additional study and validation of potential risk and benefit. 

4.3 HUMAN FACTORS CONSIDERATIONS (TASK 6.2). 

The FAA requires that every Boeing airplane provide engine parameter indications in a 

dedicated area on the interface. Engine indications, generally, support two types of activities. 

First, during normal operating regimes, the engine indications support the crew in engine start 

and shutdown and in thrust setting and monitoring. Second, the engine indications support the 

flight crew in monitoring engine operational status and health. In addition, when there are 

engine problems that lead to nonnormal operations, engine indications support the use of 

nonnormal procedures. More generally, engine-related tasks can be broken into performancemonitoring and health-monitoring tasks. 

4.3.1 Introduction. 

In this section, the first discussion concerns the current indications and how they are used for 

performance-monitoring and health-monitoring tasks. Next, a review of the aspects of the 

current indications are discussed where enhancements may be desirable, followed by a 

discussion of how a human-centered approach to flight deck design can guide flight deck 

indications for engine-related tasks. Guidance is offered relating to supporting engine 

management tasks and, more specifically, the potential role of specific indication types. 

Relevant research on engine indications and on allocation of tasks to humans and machines is 

discussed to offer ideas about the types of enhancements that might make sense. In the final 

section, recommendations for improving engine indications in the short- and long-term are 

offered. 

4-85
4.3.2 Engine-Related Flight Crew Tasks. 

The following engine indications are provided on the flight deck interface to support enginerelated flight crew tasks: N1, EPR (for some engine manufacturers), N2, EGT, fuel flow, oil 

pressure, oil quantity, oil temperature, and engine vibration. Note that these are split into 

primary and secondary indications, where the primary indications are N1, EPR, and EGT. The 

others are secondary indications. Primary indications must be displayed at all times; secondary 

indications can be selected for display by the flight crew and are automatically displayed (popup) under certain conditions. These indications are described in more detail in section 4.2. 

Engine-related tasks can be separated into performance-monitoring tasks and health-monitoring 

tasks (which also include managing nonnormals). This distinction relates to the operational 

purpose underlying monitoring—why monitoring is important. Appendix B offers a more 

detailed model of monitoring processes, which provides the underlying foundation for 

monitoring behavior, including sources of error. 

4.3.2.1 Engine Performance Monitoring. 

Performance monitoring involves determining whether the engines (or propulsion system, which 

comprises fuel tanks and fuel transfer systems along with the engines) are responding normally 

(acceptably) to manual or autothrottle inputs. More specifically, the flight crew must determine 

whether the actual engine state equals, or is approaching, the commanded engine state. 

Typically, performance-monitoring tasks are tied to significant propulsion system changes 

associated with a flight phase change or high-power maneuver such as Takeoff/Go-Around or 

Descent. In many cases, the magnitude of change in engine indications is large and often rapid. 

In the case of high-power operations, performance is at or near engine operating limits, where 

the potential for exceeding a recommended engine limit is increased. Failures in performance 

monitoring, e.g., lack of awareness that actual state does not equal commanded state, are often a 

major element in PSM events that result in crew error or UCR (see section 4.1). 

4.3.2.1.1 Thrust Setting. 

A primary flight crew task is setting the appropriate thrust level for a flight phase or maneuver. 

The engine indications that are used for thrust setting are primarily N1 or EPR, depending on the 

engine type. These parameters are stand-ins for actual thrust (true thrust, in pounds, is not 

derived and displayed). N1 and EPR indications also show commanded thrust, target thrust, and 

thrust limit to assist the crew in setting thrust. 

4.3.2.1.2 Engine Start and Shutdown. 

For engine start, the relevant engine indications are determined by whether the start is a manual 

start or is controlled by an autostart function (in some aircraft). For manual starts, the relevant 

engine indications used (by procedure) are core speed (N2 or N3), fan speed (N1), EGT, and oil 

pressure; fuel flow is also often monitored. For autostarts, the engine indications used (by 

procedure) are oil pressure and EGT—specifically, confirming oil pressure increase after initial 

4-86
EGT rise. Although not required by procedure, turbine fan speed (N1) and fuel flow are also 

often monitored. If there is a starting anomaly during autostart, automated corrective actions are 

taken and, if the anomaly remains, an alerting message is presented to the flight crew. 

For engine shutdown, no engine indications are required procedurally, but turbine speeds (N1, 

N2, N3), EGT, and fuel flow can be used to confirm that a shutdown is completed normally. The 

primary indication that an engine has not shutdown is a fuel shutoff valve alert, which can 

indicate that fuel is still being delivered to the engine. Engine indications can be used to confirm

this and to confirm when the engine completes shutdown. 

4.3.2.2 Crew Engine Health Monitoring (and Managing Nonnormals). 

Crew health monitoring involves determining that the engines and propulsion system are not 

exceeding normal operational bounds, but may also involve evaluations relative to optimal 

performance. Typically, health monitoring seeks to confirm that long-term, steady-state 

indications are not changing significantly, i.e., they are not deviating from the expected/normal 

state. A primary concern here is human failure to detect deviations from normal in a timely way. 

In the rare cases in which a PSM occurs, the flight crew must detect that a parameter value is out 

of bounds (or off expected value), understand what is occurring, and make an appropriate 

response. In the case that an EICAS message is used to alert the crew to a nonnormal condition, 

there is a direct link to a nonnormal checklist that can guide the response. In cases for which 

there is no EICAS message, the flight crew must identify an appropriate checklist (the so-called 

unannunciated nonnormal checklists) through their own interpretation of events. The important 

point is that the flight crew must move from observing engine indications to developing and 

executing a response. Possible flight crew actions include reducing throttles, shutting down an 

engine, or executing a nonnormal checklist (e.g., engine surge). Other flight control actions may 

be needed to manage the airplane. 

4.3.3 Enhancement Opportunities for Current Indications. 

Current engine indications evolved out of earlier flight deck designs in which individual 

parameters were presented to flight crews through mechanical (or electromechanical) analog 

gauges. This mechanical technology was restricted to presenting a single indication for each 

sensor (sometimes referred to as a single-sensor, single-indicator interface design). Later 

interface designs moved away from mechanical gauges to digital data presented on CRT or 

liquid crystal (LCD) displays. However, even though the interface technology shifted 

significantly, the presentation of engine parameters did not change substantially. The approach 

was still based on the presentation of individual parameters (in large part due to FAA regulations 

that require those parameters be displayed). One area of improvement, made possible by the 

new technology, was the enhancement of context for each indication. For example, individual 

indication formats changed to show the variation in expected and maximum values as the thrust 

reference value changed. And, more generally, indications became easier to read and 

understand. More recent Boeing models (737-NG and 777) use display formats that more clearly 

show limit exceedances and show the difference between commanded and actual values (see 

section 4.2). 

4-87
Potential improvements to the current engine indications through a review of the research 

literature, as well as through discussions within Boeing and with airlines, have been identified. 

The two most significant areas center around two issues: detection of change and interpretation 

of change. A minor potential improvement involves the placement and normalization of the 

primary thrust indication. 

4.3.3.1 Detection of Change. 

There are typically eight or nine engine parameters displayed to the flight crew for each engine. 

In the most current Boeing production aircraft, they are split between primary (displayed fulltime) and secondary engine displays (selectable displays). These parameters (with the exception 

of fuel flow, vibration, and oil quantity) are bounded by threshold values (operating limits). 

When a parameter exceeds a threshold value, the indication changes color to amber or red, 

depending on the type of limit and urgency of response. 

In a few cases, an EICAS alert message is also generated. Typically, on Boeing models, an 

EICAS advisory- or caution-level message is generated for oil temperature and oil pressure 

exceedances. Also, an EICAS advisory message is generated when engine control is preventing 

exceedances in N1, N2, or N3. The other parameters (e.g., EGT) have no associated EICAS 

alerting messages but rely on flight crew detection of a color change in, or video reversal of, the 

indication. The secondary indications, normally hidden, automatically pop-up on the lower 

EICAS display when one of the secondary parameters has an exceedance. 

To detect a change in an indication, flight crews, for the most part, are required to observe the 

indication. However, they may spend little time monitoring the upper EICAS display where the 

primary engine indications reside. Moreover, there are no procedural requirements for 

displaying (to monitor) the selectable secondary indications. In addition, for some conditions, 

the flight crew is required to use compacted indications instead of the standard engine 

indications. Specifically, a dual-engine failure leading to standby power or a transition to the use 

of the electronic checklist forces a switch to the compacted engine displays. These displays use 

a digital presentation (instead of an analog presentation) and are less familiar to the fight crew. 

Crew training typically emphasizes the need to include the upper EICAS as part of the routine 

scan. However, as described below, one eye-tracking study shows that pilots monitor the upper 

EICAS approximately 1%-2% of the time (Mumaw, et al., 2000). Certainly, other indications, 

such as a yaw or engine-related noise, may motivate the crew to monitor engine indications, but 

without strong cues, engine indication changes may not be detected quickly. 

Other types of engine parameter changes or anomalies can be even harder to detect because the 

indications change in more subtle ways. For example, thrust asymmetry may be quite subtle, 

especially when the thrust levers are in the same position and the asymmetry’s effect on airplane 

performance is masked by an automated compensation. The crew may be required to detect a 

difference in position between two round-dial indications that are placed side by side. While 

there are no performance data on this task, it appears to be a relatively difficult task (especially if

the crew is not looking for a difference). Also, detecting parameter changes within the normal 

4-88
range (e.g., fluctuations, a trend towards limit values) may require careful, repeated monitoring 

of the engine indication. 

In the case of secondary engine indications (e.g., oil quantity), trend monitoring is not done, and 

changes within the normal range (e.g., slow degradations) are unlikely to be monitored (or 

detected). If, for example, oil quantity is decreasing slowly over the first half of a long flight, the 

crew may not become aware of the situation until they are far from a diversion airport. 

4.3.3.2 Interpretation of Change. 

Another area to consider is the suggestion that flight crews have trouble interpreting the meaning 

of change when it is detected. Engine status is represented as a set of individual parameter 

indications, and the flight crew must derive higher-level descriptions of engine state from these 

individual indications. A Boeing study, described below, illustrates the problem. 

Shontz (1996) conducted a simulator study regarding the handling of an engine surge. Shontz 

used a B767-200 full-flight simulator to simulate the effects of a surge. Shontz presented each 

pilot subject (B767-200-qualified instructor pilots) with one of three types of surges during 

takeoff and climb-out: self-recovering, recoverable with crew action (thrust lever reduction), and 

nonrecoverable (where engine shutdown was required). Pilots were unaware that the scenario 

would involve a surge (or any PSM); they were expecting a CFIT scenario. 

Shontz found that only 3 of the 18 pilots were able to identify that a surge had occurred and 

which engine was surging within the 11 seconds available (before EGT reached the red line and 

made clear which engine had failed). Specific pilot responses varied by surge type. 

None of the six pilots who experienced the self-recovering surge, which only lasted 3.5 seconds, 

took any action—thus, they made the appropriate response, which was no response, in this very 

brief window of opportunity. After the event, only two of the six pilots correctly identified the 

event as a surge; the other four had no idea what had happened. 

In the case of the recoverable surge, the correct response is to reduce thrust and then restore it if 

the engine behaves as expected. Although all six pilots appropriately moved the thrust lever, 

only one did so within the 11 seconds (he also determined what event occurred). The other five 

pilots moved the thrust lever after EGT reached the red line. Notably, three of the pilots 

needlessly shutdown the engine. The two pilots who allowed EGT to go to the red line limit 

maintained the engine at idle instead of trying to restore full thrust after the surge. 

In the case of the nonrecoverable surge, the correct response is to reduce thrust to determine how 

the engine responds. All six pilots took this action; two of them recognized a PSM within 11 

seconds and brought the thrust lever back to idle, eventually shutting down the engine. The 

other four reduced the thrust lever to idle only after EGT reached the red line, and they 

eventually shutdown the engine (which was appropriate). However, these four did not recognize 

that a surge was occurring. 

4-89
Thus, although few pilots understood what had occurred, most pilots eventually responded (or 

offered no response) in a safe and acceptable way. Pilot responses were prompted primarily by 

seeing EGT go to the red line. In fact, 9 of the 12 subjects (in the recoverable with pilot action 

and the nonrecoverable conditions) did not recognize that a PSM existed until the EGT red line 

occurred. Importantly, no pilot, given any type of surge, called for or reduced thrust on the 

wrong engine. However, none of the 18 pilots followed through as desired by calling for the 

stall/surge checklist. Instead, pilots called for a variety of checklists: engine shutdown, engine 

failure, and engine fire/severe damage. In summary, very few pilots appeared to get sufficient 

information in a timely manner from the engine indications available to them. 

This single simulator study demonstrates that skilled pilots can fail to interpret/understand 

engine parameter changes and exceedances and, therefore, fail to follow through correctly. 

Similar reports come from airlines. They report, for example, that pilots can have difficulty 

knowing when to use the engine severe damage checklist because it is not clear when damage is 

severe. In general, the following conditions can be difficult for flight crews to recognize (or 

recognize in a timely manner) from the engine indications: 

• Engine surge—identifying that a surge has occurred and to which engine, and being able 

to differentiate, before taking action, between recoverable with pilot action and not 

recoverable (shutdown required) types. 

• Runaway engine—identifying the occurrence of a runaway engine, where the engine fails 

at high thrust (e.g., the engine fuel valve fails wide open). There is no response to 

throttle, so the engine cannot be controlled. 

• Engine damage—specifically, being able to determine whether engine restart is possible. 

• Severe engine damage—being able to determine whether a malfunctioning or failed 

engine must be shutdown or isolated (which requires the additional action of pulling the 

fire handle) due to severe damage. The flight crew has to determine which action to take 

based on an interpretation of engine conditions. 

• Engine degradation—when engine parameters are trending toward or approaching limits, 

determining whether the degradation is operationally significant even though it has not 

exceeded the normal range. 

• Engine vibration levels—determining when vibration is significant/meaningful and when 

power reduction is appropriate versus when shutdown is appropriate. 

An example in-service event illustrates the larger point. At approximately 300 ft AGL after 

takeoff, the airplane experienced a continuous engine surge on the no. 3 engine. The flight crew 

initially believed they had a gear or tire failure, and the engine surge detection/recovery logic 

masked the engine indications. A correct diagnosis was further delayed because severe vibration 

made it difficult for the crew to read the flight deck instruments. As a consequence, the flight 

crew became inappropriately distracted by the failure, eventually neglecting airplane airspeed, 

4-90
altitude, and heading. A CFIT was narrowly avoided. The no. 3 engine EGT gauge exceedance 

annunciation eventually made clear which engine was affected. 

The point here is that even when a flight crew detects significant changes in airplane 

performance or engine parameters, which in the case of surge may be brief, transient changes, it 

can be very difficult to interpret or understand those changes (or perhaps, even determine which 

engine is affected) and determine how to respond. Detection and interpretation tasks require 

substantial knowledge, effort, and time on the part of the flight crew to identify and understand 

the PSM and formulate the appropriate response. This time will not always be available. A 

further complication is that because airplane systems are becoming more reliable, pilot training 

in systems is trending away from detailed, in-depth systems knowledge. This training trend 

leaves pilots a little less well prepared to reach the correct understanding and initiate the most 

appropriate response. 

There is a range of potential consequences for failing to detect or correctly interpret a PSM, e.g., 

shutdown an engine unnecessarily or fail to correct a thrust asymmetry. These actions, in turn, 

can lead to a range of airplane effects, from reduced capability on an engine to more serious 

cases such as LOC. The AIA PSM+ICR report (section 4.1) further describes the ways in which 

flight crew confusion can lead to airplane damage, a hull loss, or even fatalities. 

4.3.3.3 Thrust Indication. 

Two issues have been raised regarding thrust indication. First, Abbott (1990, 2000) has noted 

that the thrust indication shown is not a true thrust (i.e., not expressed in pounds of thrust), but 

uses other parameters that may be directly related to thrust: N1 and EPR. Abbott proposes 

deriving a true thrust index from a larger set of parameters. Some rare failure modes can 

significantly distort the relationship between these displayed parameters and true thrust. One 

example is offered by an accident in which the displayed thrust indication, EPR, may have 

misled the flight crew. Due to an iced pressure probe, EPR indications did not represent actual 

thrust and led the flight crew to believe they had sufficient takeoff thrust (though they did not). 

Although airplane performance provided some potential cues to the flight crew, they did not 

integrate them fully and see the complete picture. The airplane failed to climb, stalled, and 

crashed shortly after liftoff. A more direct indication of thrust might have aided the crew in 

seeing the discrepancy between indicated EPR and actual thrust. 

Another benefit Abbott believes would be created by a change to true thrust is that thrust can 

always be normalized so that the flight crew sees the current thrust value in reference to 100% of 

maximum available thrust (no matter where the thrust reference value is set). When this is done, 

the maximum thrust level is always indicated at the same place on the round dial. Abbott 

believes that this consistency could aid flight crews in assessing the current thrust value. This is 

a case where the evolution of indications has provided this feature. The presentation of EPR in 

certain Boeing aircraft uses a normalized scale and achieves the benefit of a consistent position 

of maximum thrust value.

4-91
A second issue is the placement of, or integration of, the thrust indication. N1 or EPR are placed 

on the upper EICAS, away from the PFD. However, in some cases, a manual thrust setting is 

used to meet flight control targets (airspeed, altitude, or path). Ideally, thrust might be better 

integrated into the PFD to facilitate execution of flight control tasks; for example, to provide the 

pilot direct feedback on whether the current commanded thrust will allow him/her to achieve the 

desired target. Note, however, that the actual thrust value may not be the ideal piece of 

information to support these flight control tasks. Instead, the pilot may need something like 

potential gamma (as provided on some head-up displays), which is more of a direct indication of 

acceleration. 

One example of linking thrust setting to a flight target is the use of the green arc on the ND. The 

green arc appears on the ND as a predictor for the location at which the airplane will reach the 

altitude target set on the MCP. Pilots, when climbing or descending to a target altitude at a 

waypoint, can adjust the thrust levers until the green arc intersects the waypoint, which ensures 

they will reach that altitude at that point. This integration provides a direct link between a flight 

target and the thrust-setting task. 

4.3.3.4 Accident/Incident Literature. 

Another important source for identifying safety concerns associated with the monitoring of 

engine indications are the recorded accidents and incidents involving UCRs to PSMs. A recently 

completed review of a PSM incident database (section 4.2 of Clark and Winters) analyzed 81 

cases of UCR, including LOC, SDGE, RTO at a speed greater than V1, and other events that 

mainly involve failure to select or complete the appropriate nonnormal procedure. Consistent 

contributing factors in these incidents were the failures to detect a malfunction in a timely way, 

diagnose, and correctly respond to the PSM. 

Overall, Clark and Winters estimate that the likelihood of a PSM—specifically, a PSM that 

occurs during the flight phases where the occurrence of a UCR is a safety concern—is on the 

order of 1 in every 20,000 flights. The PSMs most likely to occur are surge, oil system

exceedances, powerloss, and high vibration. Further, they found 

• Unannunciated engine malfunctions, such as Powerloss, Surge, and Failed Fixed Thrust, 

are the most likely to involve UCR. 

• Oil system malfunctions, although one of the most likely to occur, are one of the least 

likely to involve UCR. Oil system malfunctions are unambiguously annunciated through 

EICAS and generally do not develop rapidly (i.e., involve short timelines or time-critical 

scenarios). 

• The likelihood of a PSM-related UCR is estimated to be 2.6E-07, or approximately one 

event in every 3.8 million flights. 

• The likelihood of hull loss due to PSM-related UCR is estimated to be 7.5E-08, or 

approximately one event in every 13.3 million flights. 

4-92
Thus, Clark and Winters show that the combination of a PSM and UCR rarely leads to a serious 

accident. It appears that even though crews may fail to detect or understand what is happening 

when a PSM occurs, the flight crew response is unlikely to lead to more serious problems, such 

as LOC. In fact, the Shontz study demonstrated just this fact. It showed that although only 3 of 

18 subjects knew there was a surge, all responded in an acceptably safe, albeit incorrect, manner. 

However, three subjects unnecessarily shutdown an engine, and two others left an engine 

running at idle when it could have provided normal thrust. These are situations that can be 

managed quite safely. 

While the very low engine malfunction and UCR accident rates are somewhat reassuring, there is 

still value in ensuring that crews detect in a timely manner, correctly interpret, and fully 

understand PSMs and their implications in terms of the state of the propulsion and higher-level 

airplane systems and mission. In fact, ideally, the flight deck interface design and associated 

procedures should be as foolproof as possible in aiding flight crews to move from a PSM to an 

appropriate response. 

4.3.4 Role of the Flight Deck Interface in Propulsion System Management. 

Given the range of flight crew tasks that are required and the above considerations, the following 

sections discuss how the flight deck interface should support propulsion system management 

(from a human performance perspective). The following also offers design guidance, at a high 

level, for the flight deck interface design. 

4.3.4.1 Supporting Performance Monitoring. 

The flight deck interface must support the flight crew in monitoring and controlling propulsion 

system performance, specifically, the fuel system and engines. An important step in interface 

design is defining the types of feedback the flight crew needs in system management. 

Feedback first comes from showing the commanded value, which shows the flight crew what 

parameter target has been set (by them or by the automated agent). To assess performance, the 

parameter’s actual value needs to be shown along with the commanded value. These two 

together tell the flight crew how well the system is meeting the target set for an individual 

parameter. 

Then, the interface needs to provide feedback at a higher level of system description. First, it is 

important for the flight crew to know how the physical system (in this case, the fuel system) is 

configured and operating. This information supports flight crew assessment of, and changes to, 

the configuration. Also, the crew needs to know (at some level of description) fuel quantity and 

location, whether fuel is being distributed from the tanks to the engines, and fuel consumption or 

fuel flow rate to the engines. This information allows the crew to construct a situation model 

(see appendix B for a discussion of the situation model) and answer questions that may arise, 

such as 

• 

• 

Am I drawing fuel from a tank with fuel in it? 

Am I balancing fuel in my fuel tanks?

4-93
• 

• 

• 

• 

Am I configuring pumps to get the fuel to the engines? 

Is there a fuel leak somewhere in the system? 

In addition to feedback on how the physical system is functioning (i.e., configured and 

operating), the flight crew needs feedback on how well the fuel system and engines are achieving 

the objectives needed for the mission. This can also be referred to as airplane effects or missionlevel effects. This feedback tells the flight crew what effects the fuel system and engines are 

having on airplane-level functions and the mission objectives. Examples of these are 

Range Objectives: Can we make it to the intended destination? What airports can we 

reach? 

Aviate Objectives: What limitations are there on maneuvering? What limitations are 

there on landing?

A more formal version of this multiple-level feedback scheme was developed by Rasmussen 

(1985), who established the abstraction hierarchy (AH) framework for supporting system

management. Vicente (1999) has elaborated on the AH framework and worked through several 

detailed examples in his book. The AH provides system descriptions that allow designers and 

operators to consider the system from different perspectives; the levels are as follows: 

• Physical form—this level describes equipment layout and the physical appearance and 

condition of the system. 

• Physical function—this level describes the state of the physical components (e.g., settings 

on pumps or valves) and how components are connected and configured for operation. 

• Generalized function—the functions that the system is designed to achieve (e.g., flow or 

storage of fuel, compression, and combustion) and the state of system functions 

(independent of the state of the equipment that creates those functions). 

• Abstract function—first principles-type description of system performance (mass, 

energy, or information flows). 

• Functional purpose—overall system purpose (What is the system doing for the airplane 

and its mission?) 

Generally, AH levels move from physical properties of the system (lower levels) to functional 

properties/purpose (higher levels). Understanding and addressing problems at one level often 

can require understanding system actions at the next lower level. That is, physical components 

can be configured to achieve system functions, and combining system functions is required to 

achieve the overall system function. Vicente demonstrates how these levels are linked and, 

especially, how system representations can be used to support knowledge-based performance 

(reasoning through the system) (see the discussion in section 4.3.5.1 of Dinadis and Vicente’s 

engine display developed from an AH analysis; also see section C.2 in appendix C for a 

discussion of knowledge-based performance). For now, one must carry forward the simpler 

4-94
notion that system operators can benefit from representations of both the physical system and the 

system function (purpose). Such benefits may include increased situation awareness and, 

ultimately, better decision-making and action. 

4.3.4.2 Supporting Monitoring Engine Health and Managing Nonnormals. 

The interface must also support the flight crew in a very different way for monitoring engine 

health and then managing nonnormals when they occur. There are three general functions that 

the interface must provide: 

• Monitoring/alerting/orienting 

• Understanding 

• Guiding to appropriate action 

4.3.4.2.1 Monitoring/Alerting/Orienting. 

The airplane senses and displays many parameter values, and these values change over time as 

the airplane progresses through its mission. Some parameter changes are more meaningful 

because they indicate that the airplane has transitioned into a nonnormal operating regime; for 

example, a component fails and airplane system functions are degraded or lost. It is important 

that the flight crew be aware of these meaningful changes. Because it is not possible for a flight 

crew to monitor all indications all of the time, systems have been designed that can, at least 

partially, monitor and alert the flight crew automatically when a meaningful change occurs. 

Effective alerting requires that meaningful changes attract (grab) the flight crew’s attention. 

Placing alert indications where the crew is likely to be looking and making them salient (e.g., 

accompanied by loud aurals, bright, flashing, colorful) are important for effectiveness. Placing 

alerting messages in a central alerting area (e.g., EICAS) can also be effective. Thus, initially, 

the interface’s primary role is to alert the flight crew to the change. However, it is useful if the 

alerting function can simultaneously convey the following additional information: the nature of 

the change (i.e., What system or component, and how has it changed?), the severity of the 

change (i.e., How greatly will it affect airplane performance? How rapidly is a response 

required?), and where they can get further information on the change (this is the orienting 

element). 

4.3.4.2.2 Understanding. 

After they are alerted to a meaningful condition, the flight crew needs to understand how this 

condition affects airplane operation. This should happen at two levels: the physical system and 

airplane effects (i.e., functional level). For the physical system, the flight crew needs to 

understand how the system configuration and state of operating components has changed. If 

there are automatic system control actions when a failure occurs, the crew should be able to see 

how those actions have changed the configuration (e.g., Is a different fuel pump working to 

replace the failed one? Is fuel being drawn from a different tank? Is some automatic process 

now initiated to compensate for the failure?). More important, at the level of airplane effects, the 

flight crew needs to understand how airplane performance is affected (e.g., Am I unable to reach 

the original destination? Will I have less fuel reserves?). Note that some judgment is required in 

4-95
determining how much detail and depth is needed to ensure the flight crew understands the 

change that has occurred. In particular, the designer needs to decide the level at which system

components should be represented and how those components should be represented. 

4.3.4.2.3 Guiding Crew Actions/Response. 

Finally, the flight crew must be guided to the set of appropriate actions that need to be taken, 

either immediately or at a later time. Often, a nonnormal checklist is used to inform and guide 

actions. These checklists are linked to an EICAS message or to lighted alerting messages on or 

around the interface. Immediate actions may be taken, or there may be other decisions or actions 

required at a later time—for example, a procedure may need to be adapted due to a failure in a 

critical system, or there may be limitations on maneuvering at the time of landing. Somehow, 

the interface must support the flight crew in making sound decisions and in taking appropriate 

actions. 

In other cases, there is no discrete indication such as an EICAS message that directs the flight 

crew to an appropriate nonnormal checklist. Instead, there are unannunciated checklists that the 

crew must initiate on their own. The flight crew needs to remember that a relevant nonnormal 

checklist exists (e.g., engine surge) and retrieve it. Thus, in these cases, the flight deck interface 

does not provide guidance to the crew because this level of describing engine state is not 

available; they are on their own to recognize the need and seek it out. This approach demands 

more of the flight crew and can lead to ICR. 

4.3.5 Designing for Engine-Related Tasks. 

In the previous sections, how the interface should support engine-related performance- and 

health-monitoring tasks were described (at a high level). In this section, motivated by this 

conception, alternatives to the current engine parameter indications are considered. To establish 

a reference point, the current indications can be characterized in the following way: 

• Engine representation: 

− The indications represent individual engine parameters for each engine. 

• Alerting scheme: 

− For some exceedances, an EICAS alert message is provided (in airplanes with 

EICAS); this is a centralized alerting scheme. 

− For other exceedances, the flight crew must detect a change in the indication; this 

is an indication-based alerting scheme. An example of indication change is a 

color change. 

• Interpretation/understanding: 

− In some cases EICAS messages identify a specific engine state, e.g., engine fail. 

4-96
− In some cases, the flight crew is required to assess the state of the fuel system and 

engine from individual parameters, such as N1, EGT, oil pressure, oil 

temperature. 

• Response guidance: 

− In some cases, EICAS messages are provided to identify the appropriate 

nonnormal procedure. 

− In the cases where there is an absence of a specific malfunction indication or 

alert, there is a reliance on crew training to interpret correctly and determine the 

appropriate response, e.g., fuel leak, surge, or severe engine damage. 

In the following consideration of alternative approaches to this scheme, two issues were 

discussed: level of representation and level of support from the interface. 

4.3.5.1 Level of Representation. 

Level of representation refers to the representation of an airplane system, such as an engine. At 

the lowest level, the engine is represented only by individual sensor-based parameters, which is 

the situation in today’s flight decks. The flight deck interface presents each parameter directly 

and does not provide any higher-level representation of the state of the engine or fuel system. 

There are a few EICAS messages that provide higher-level descriptions of the engine state 

(e.g., engine fail and engine fire), but in terms of how the flight crew monitors each engine, it is 

viewed solely as individual parameters. 

A small shift away from this approach would lead to indicating derived indices, such as true 

thrust (see Abbott, 2000), that may be more closely aligned with supporting flight crew tasks. 

More dramatic shifts lead to displays that show a more integrated engine status. For example, 

one could indicate whether the engine is good, meaning that all indications are within the normal 

range. One could also indicate the presence of faults or performance shifts, such as surge or fail 

fixed (or even degraded conditions within the normal range). 

In the context of military aviation, Dinadis and Vicente (1999) reviewed engine indications in a 

Lockheed Hercules C-130. They began by applying an AH analysis and found that only the 

upper and lower levels of the AH were represented in the flight deck interface. They then went 

on to develop interface tools to support each level of the AH and proposed an engine/fuel system

display with six regions, each having different representations of the engine and fuel system (see 

figure 4-13). Note that this display is quite different from the engine indications on today’s 

commercial airplanes. 

At the functional purpose level of the AH, they proposed a display related to the overall purpose 

of the engine and fuel systems, which is to reach a desired destination. This display (the upper 

left area of figure 4-13) focuses on airplane range based on variables such as fuel level, engine 

efficiencies, airspeeds, outside air temperature, and altitudes. The outcome of this computation 

is represented as minimum and maximum ranges from current position on a map display. 

4-97
4-98

FIGURE 4-13. ENGINE/FUEL DISPLAY FOR A C-130 (Dinadis and Vicente, 1999) 
The next level of the AH addresses each engine’s purpose, which is to perform effectively and 

efficiently and to produce thrust. This area of the display (upper center and right areas of 

figure 4-13) provides an overview of each engine by showing 12 individual parameters 

organized into a polygon display. Each of the 12 parameters is normalized across engine power 

level. If there is a deviation on any parameter, the polygon changes from its regular shape (see 

figure 4-14). There are also caution and warning boundaries on each parameter that lead to a 

color change when the actual value crosses the threshold. 

The next level of the AH shows the fuel system’s purpose and functions. Similar to current 

synoptics, it shows fuel flow to each engine, tank fuel levels and flow indications, and 

information to support leak detection, including predicted fuel amounts (left center area of 

figure 4-13). The level below this one is a system display that provides a schematic 

representation of the physical fuel system and engines (lower right area of figure 4-13). This 

display element allows the flight crew to see the configuration of tanks, pumps, valves, etc., 

(with their current settings) that make up the system. 

The final display component is an area that Dinadis and Vicente call systems information; this is 

meant to facilitate movement between the overview displays and the more detailed system

displays. The first is an engine state diagram (energy x entropy) that shows both the expected 

behavior of each engine along with its current state (center right area of figure 4-13). A pilot can 

use these displays to get to a trend display (not shown) on various engine parameters. 

There are several points to make regarding how this display applies to commercial aviation. 

First, the display uses too much interface real estate, and it would be difficult to keep it displayed 

full-time on the interface. All or part of it may work as a selectable display that can be called up 

when needed. Second, this display is meant to support knowledge-based (KB) performance as 

well as rule-based performance (see appendix C, section C.2 for further discussion of these 

concepts). Current commercial fight decks may not have the same mission to support KB 

performance, although as mentioned earlier, there needs to be some tools on the flight deck to 

support unanticipated scenarios requiring KB performance (the need for KB performance is 

guaranteed to occur at some point). Third, this display makes a major leap forward in presenting 

the fuel system and engine state at higher levels of description. Although it may not survive in 

its current form, it is worth exploring these ideas on how to communicate functional information 

regarding the propulsion system. 

4.3.5.2 Level of Support From the Flight Deck Interface. 

In this section, a distinction will be made between what the flight crew is responsible for and 

what the interface (automation) does for the crew. Section 4.3.4.2 described three necessary 

functions for managing nonnormals: monitoring/alerting, interpreting/ understanding, and 

guidance to an appropriate action. Interestingly, the few major research projects on engine 

indications have targeted the monitoring/alerting function (probably due to the FAA 

specification of the engine information that must be provided). 

4-99
4-100

FIGURE 4-14. C-130 ENGINE/FUEL DISPLAY WITH SYSTEM FAULT (Dinadis and Vicente, 1999) 
4.3.5.2.1 Research Findings. 

4.3.5.2.1.1 Abbott Study. 

Abbott (1990, 2000) focused primarily on supporting pilot health monitoring by converting each 

indication to a column deviation graph (see figure 4-15), called the Engine Monitoring and 

Control System (E-MACS) display. This graphical format focuses on two issues: easier 

detection of any deviation and, in particular, detection of deviations from the expected parameter 

value. Abbott claims that in addition to deviations that cross caution and warning thresholds, 

pilots care about deviations from the expected value of each parameter since this deviation may 

indicate a degraded level of performance (although it is short of being out of the normal range). 

In E-MACS, expected values come from a model of the system, and each parameter is then 

compared to that expected value. If the actual parameter value is the same as the expected value, 

the deviation graph will show zero deviation. The deviation graph also shows where the amber 

(caution) and red (warning) thresholds are. As figure 4-15 shows, Abbott normalized all 

parameters to have these thresholds lineup. 

parameter values

upper limit (red)

upper warning (red)

upper caution (yellow)

normal (green)

lower caution (yellow)

lower warning (red)

lower limit (red)

FIGURE 4-15. THE E-MACS DISPLAY (Abbott, 2000) 

Figure 4-16 shows several comparisons of the E-MACS display to a standard engine display. 

The EMACS is slightly modified from the display shown in figure 4-15. In addition to the 

deviation scales, Abbott developed an alternative thrust indication (on the left side). Also, the 

parameters are grouped separately for each engine. Figure 4-16a compares a conventional 

engine display and the E-MACS concept for a normal, power-up condition. Figure 4-16b 

compares the two display schemes for a nonnormal condition. The E-MACS display shows 

erroneously high power information (the yellow bars on the left side). However, the E-MACS 

display also shows that both EGT and fuel flow are much too low for the amount of power the 

engine is supposedly producing. 

4-101
757 E-MACS

FIGURE 4-16a. THE E-MACS AND TRADITIONAL ENGINE INDICATIONS—NORMAL POWER-UP (NASA LANGLEY)

757 E-MACS

4-102

FIGURE 4-16b. THE E-MACS AND TRADITIONAL STANDARD ENGINE INDICATIONS (NASA LANGLEY) 
Abbott ran a study to compare the E-MACS display to the traditional engine display. Abbot put 

16 pilot subjects in a fixed-base simulator and ran them through several scenarios, once with the 

E-MACS display and once with the traditional display. The subjects were required to detect 

exceedances (without the support of EICAS alerting). Abbot found that with the E-MACS 

display, all 32 exceedances were detected. However, the subjects failed to detect 14 of the 32 

exceedances with the traditional engine display. Also, a questionnaire showed that the pilots 

preferred the E-MACS display to the traditional display. 

4.3.5.2.1.2 Hornsby Study. 

Hornsby (1992) also conducted a simulator study that manipulated engine indications. In this 

case, Hornsby maintained the traditional Boeing engine indications but enhanced them in various 

ways:

• Added an EICAS message whenever any engine indication exceeded caution or warning 

thresholds. 

• Added a green band to the parameter indication to show its nominal range (based on an 

engine model). The display changes color when the current value exceeds this range. 

• Added an EICAS message, saying “monitor parameter,” whenever the current value 

exceeds the nominal range (but the nominal range is not shown). 

Five engine indication conditions were created by using these enhancements alone and in 

combination (with the traditional engine display as condition 1). Hornsby had 10 pilot subjects 

fly multiple scenarios with each of these engine displays to compare performance (time to detect 

and the accuracy of identifying the problem). Hornsby found that detection time was decreased 

significantly by adding EICAS messages. The monitor parameter messages were also effective 

in decreasing detection time. Further, the enhancement of EICAS alerting messages (for 

exceeding caution and warning limits) was most preferred by the subjects. The green bands did 

not aid detection time and were not preferred by the subjects. 

In terms of accuracy of identifying the fault, interestingly, the monitor parameter message hurt 

performance. This message decreased detection time but was insufficient for the subject to 

describe what the problem was. Then, the more informative message that followed (the EICAS 

alert) was often removed (artificially) by the time the subject looked there. Note that in a rating 

task, the subjects rated the display with all the enhancements as the easiest to interpret. 

4.3.5.2.1.3 Summers Study. 

In the other large study on engine indications (Summers, 1993), enhanced engine displays again 

showed superior performance. Summers compared the traditional MD-11 engine display with 

the E-MACS display and an approach that did automatic alerting. The traditional display used 

vertical bars to represent current values on engine parameters. The E-MACS display converted 

those to the column deviation format. The third engine display used a design-by-exception rule 

(DBE) that uses the engine model to monitor engine parameters automatically. Whenever an 

engine parameter differs significantly from the expected value, the crew is alerted through the 

4-103
central alerting system (like EICAS) and can then bring up the traditional engine indications 

(otherwise, engine indications were not displayed). 

Summers ran 12 pilot subjects through several scenarios with each engine display to compare 

performance. For detection of faults, the traditional display was the worst with 10 of 96 faults 

going undetected. All faults were detected with the newer (E-MACS and DBE) displays. 

Generally, the E-MACS and DBE displays also led to faster fault detections. However, there 

were problems in the accuracy of interpreting the fault for all displays. The newer displays did 

not seem to help the flight crews make sense of the nonnormals. (Note, however, that the 

grouping scheme used (by parameter, not by engine) may have diminished the interpretability in 

this study.) 

4.3.5.2.1.4 Conclusions. 

These three simulator studies show that monitoring/alerting enhancements can improve the 

likelihood of detection as well as time to detect an exceedance. The column deviation format 

makes deviations more easily detected, and certainly, the use of an alert message (EICAS) is a 

salient cue that a change has occurred. What is interesting, though, is that the identification of 

the fault (understanding) is not always enhanced through these new indications (although it is 

probably no worse than with current displays). Perhaps this outcome is due to the focus of these 

studies being on detection, not understanding. 

There are two larger points here. First, these new schemes maintained individual engine 

parameters; there was no integration into higher-level engine descriptions. The authors seem to 

be focusing solely on detection concerns with the traditional scheme of individual parameters. It 

should not be surprising that an EICAS message (an automated alert) is more effective at getting 

the pilot’s attention than is unaided monitoring. However, the lack of anymore integrated 

display means that flight crews will still have trouble with understanding the meaning of 

variation on the individual parameters, such as in cases like engine surge. 

The second point is that these displays were developed to enhance detection of deviations and 

may not be suited to performance monitoring and control tasks. The primary element of 

E-MACS display (the column deviation graph), in particular, is optimized for detecting 

deviations. Other elements are needed to support thrust-setting tasks. The point is that multiple 

display elements will be needed to support both performance and health monitoring (as also 

shown by Dinadis and Vicente, 1999). 

4.3.5.2.2 Alternative Schemes for Engine Indications. 

In considering alternative engine indications schemes, there are a few key questions that should 

guide design. For monitoring/alerting, the primary question is: 

How does the interface attract the flight crew’s attention that a meaningful change has occurred? 

For some PSMs, the crew will be alerted by unmediated indications—noises, smells, smoke, 

aircraft yaw. The occurrence of these may orient the flight crew to the engine display when they 

4-104
associate that cue with the engines. If changes occur only at the engine indication (e.g., color 

change, text message) on the upper EICAS display and it is critical that the flight crew be aware 

of the change immediately, then the interface designer needs to ensure that this change has 

sufficient salience to attract the flight crew’s attention. Generally, the designer needs to consider 

that this area is peripheral to where the crew’s eyes are likely to be focused (PFD/ND or out the 

window), and some orienting cue will be necessary to attract attention (e.g., aural, glareshield 

light, flashing, etc.). 

In the Abbott study, it was possible to enhance detection with an indication that more clearly 

showed deviations from the expected (the E-MACS display), but even that display requires that 

someone look at it. The most straightforward method to get attention is to announce the change 

on the EICAS, which is the central-alerting display. Again, the studies reviewed above showed 

that an EICAS message reduces detection time. 

For interpreting/understanding, there are three questions to consider initially: 

• What information types are needed to support the flight crew in assessing the fuel system

and engines?

• How should the interface describe the new state of the engine or fuel system?

• What remains working that can be used? 

The first question invites thinking about the types of information that might be provided. In 

today’s aircraft, the engine indications provide only the current parameter value. With these 

indications, values that have existed prior to right now are lost, and there is no facility for seeing 

parameter history. Therefore, the first issue is—given an individual parameter representation—

should trend information be added to the actual value for individual parameters to capture 

behavior over time? 

One form of trend information is predicted behavior over short intervals (e.g., 5 seconds). For 

example, airspeed has a predictive trend vector on it that shows where airspeed is headed. 

Similarly, engine indications could show predicted behavior, but if this is useful, it may only 

apply to a few of the engine parameters—perhaps oil quantity and EGT. The other form is a 

historical trend, which could be a separate display that allows the flight crew to see the 

parameter trend (or behavior) over any selected time period. Or, it could show a continuously 

updated x-second trend, e.g., range over the last 5 seconds. This type of trend information could 

make it possible to retrieve transient changes that are no longer present, as in the case of a surge. 

The second question is concerned with the level of representation of the engine and fuel system. 

Current engine displays rely on individual parameters. Several higher-level representations, 

notably in the Dinadis and Vicente (1999) work, were reviewed. It seems that some set of 

higher-level descriptions may be useful to make more clear to crews the state of the engine and 

any limits on its operation. Therefore, the flight deck could have interpretation capabilities built 

in to move from showing the current value on individual parameters to the current operational 

status of the engine. 

4-105
The third, but related, question, “What remains working?,” is also a critical part of the system

description. While it is important to aid the flight crew in taking action on failed systems, it is 

also important to ensure they do not take inappropriate actions on working components. Section 

4.1 of Clark and Winters describes cases in which flight crews shutdown the functioning engine. 

Note that the quiet, dark philosophy common to flight deck design might be interpreted to 

exclude showing status of components that are working as expected. However, in trying to 

guide flight crew response, it may sometimes be beneficial to explicitly indicate normal system

state or what capabilities are available. 

Representation of systems (such as the fuel system) must also be considered. There is a trend 

toward increasing the automation of system management such that certain system failures (such 

as component failures) are managed without the need for crew input. As the flight deck 

automation takes on more of the role of interpreting nonnormal variation in indications and, 

perhaps in reconfiguring systems, one issue arises: handoffs back to the crew. 

Research on expert systems (Roth, Bennett, and Woods; 1987) has shown that if an expert 

system reaches an impasse (e.g., cannot work through the interpretation), the partial solution and 

remaining problem gets handed back to the human operator (or the flight crew is told nothing 

about the actions of the automated agent). In this situation, it is desirable to support the human 

operator in completing the work (e.g., understanding engine state). The machine’s prior 

reasoning should be shared with the pilot in a concise summary. That is, the automation should 

communicate what it was looking at, what partial solutions it developed, and what remains to be 

understood (or where the uncertainty remains). In the current case, this may mean that if the 

automation cannot complete an interpretation of engine state, it should have a way to hand the 

task off to the flight crew so they can benefit from the partial solution. This may mean providing 

a meaningful display for monitoring that effectively characterizes the nonnormal variation of the 

engines. 

For guidance in responding, the primary question is: 

How does the interface lead the flight crew to take appropriate actions? 

This guidance should make clear, first, what control/controller should be acted on. There are a 

small number of crew actions that are possible with the engine, primarily, reduce throttles or shut 

it down. Fuel system interactions can be more complex. The display that supports 

understanding should also reveal what should be acted on, i.e., which control is relevant. There 

may also be a benefit in guiding the flight crew to a procedure; for example, EICAS messages, 

typically, link to a procedure. 

A second consideration is that the flight crew should get feedback on the actions they are taking 

to indicate that they are fixing the problem. Ideally, at the functional level, the crew can 

determine if propulsion-related airplane capabilities have been restored (and to what extent they 

have been restored). 

4-106
4.3.5.3 Allocation Guidelines: Human Processor Strengths and Weaknesses. 

The preceding guidelines are tied to the nature of propulsion system tasks. It is also worthwhile 

considering allocation (between humans and automation) guidelines tied to basic human 

performance issues. 

Within the history of human factors, there has been a strong desire to understand how to allocate 

functions to humans and to machines. The development of human-operated technology has 

taken the approach that humans are best suited for some tasks and machines are best suited for 

other tasks. An early version was the Fitts list (1951). Fitts determined that humans should be 

allocated tasks that involved the ability to 

• detect small amounts of visual or acoustic energy. 

• perceive visual or auditory patterns. 

• improvise and use flexible patterns. 

• recall relevant facts at the appropriate time. 

• reason inductively. 

• exercise judgment. 

Machines, on the other hand, were best suited to tasks that involved the ability to 

• respond quickly to control signals. 

• apply great force smoothly and precisely. 

• Perform repetitive, routine tasks. 

• store information briefly and then to erase it completely. 

• reason deductively (from many cases to one rule), including computational ability. 

• do many different things at once. 

This list shows that humans and machines are very different types of processors. Humans are 

adept at seeing complex patterns, at generalizing from a few cases (but are sometimes fooled), at 

assessing the full context/situation and responding appropriately, and at behaving flexibly. 

Machines do not tire, can store and process great amounts of information, and handle multiple 

computationally complex or repetitive tasks simultaneously and quickly, as long as the situation 

does not change to make the actions inappropriate. 

Not much has changed since 1951 to alter these lists of strengths and weaknesses; humans and 

computers are still essentially the same. However, what has evolved is the notion of how

designers should create technology. Instead of allocating functions as though the two processors 

(human and machine) were independent, there has been subtle but important shift to focusing on 

the human as the central processor in the system and creating technology that supports the 

human’s ability to serve this role. The current notion is that technology should be created to 

support and extend the human processor operating the system. 

4-107
4.3.5.3.1 Guidelines for Automation’s Role. 

The following sections discuss areas where automation/technology should support human 

processors (pilots) to enhance flight operations. 

Technology should be used to monitor for infrequent or subtle changes. Many years of research 

have shown that humans are poor at extended vigilance tasks (e.g., Broadbent, 1971). 

Specifically, when humans are asked to monitor a display to detect subtle or infrequent changes, 

they are not effective for very long (about 30 minutes, when there are no other tasks and they are 

highly motivated). Flight crews are rarely required to engage in sustained monitoring, but 

instead use periodic monitoring. Periodic monitoring in an operational setting is a different task 

than vigilance and is more driven by the conscious direction of attention and expectations about 

where meaningful information will be presented. 

On the flight deck, monitoring of engine and other system indications is a secondary, or lowerorder, task. Pilots are typically flying the airplane manually or engaged in some other activity 

(e.g., map reading, radio transmissions, flight management computer inputs, and visual search 

for threats) that requires their full attention. The pilot flying (PF) spends most of his/her time 

monitoring the PFD and ND during flight. In fact, several studies of pilots’ visual fixations 

during routine flight (Heuttig, et al., 1999; Mumaw, et al., 2000; and Wickens, 2000) showed 

that pilots spend roughly 60% of their time monitoring the PFD/ND in a routine flight. Further, 

Mumaw, et al. found that only about 1%-2% of total monitoring time was spent on the upper 

EICAS display, where engine indications and EICAS alert messages are presented. 

The role of technology is to carry out monitoring for the small, meaningful changes that lead to 

the need for pilot awareness or action. In most cases, the system designers (e.g., propulsion 

engineers) can identify the events that are defined as the meaningful changes pilots should 

notice. The interface then needs to turn these subtle changes in salient changes through the use 

of alerting schemes (e.g., visual and/or aural alerts). If the designer’s objective is to rely on a 

pilot to monitor for these changes, then the indications need to be located in the areas where pilot 

attention is usually dedicated. 

Technology should be used to integrate sensor information (data). Humans have limited storage 

and reasoning (processing) ability; there are limits on how many separate items can be 

considered or manipulated (Simon, 1957). Therefore, humans are limited in taking separate bits 

of data or information (e.g., variation in individual parameters) and integrating them to 

understand a larger truth (e.g., operational status of a system). 

Engine indications are presented as a set of individual parameters to be monitored, and it is 

easiest for pilots to see changes in each parameter with this scheme. Technology can be used to 

integrate separate indications to show larger effects or trends (if there are meaningful 

integrations). It is the role of the interface designer to understand the information that the flight 

crew needs and then pull together indications from sensors and controls to support crew 

awareness and understanding. A number of researchers, working in other industrial applications, 

have developed techniques for integrating individual parameters into higher-level descriptions of 

system performance that may be applicable to the flight deck (for example, see Christoferson, et 

al., 1996; Vicente, et al., 1996; Woods, Wise, and Hanes, 1982). 

4-108
Technology should be used to prevent recognition biases. As identified by Fitts (1951), humans 

are skilled at perceiving patterns and at inductive reasoning. More specifically, humans 

generalize quickly as expertise develops, learning to recognize meaningful events that are 

occurring. While this skill is often exploited to improve performance—to quickly see what is 

occurring and then react appropriately—humans also can over-generalize. That is, humans can 

see a few elements of some event and jump too quickly to the conclusion that the event is 

occurring (e.g., a loud bang from a surge is mistaken for a blown tire on rotation and the crew 

inappropriately rejects takeoff, or a loud bang from a blown tire is mistaken for a surge and the 

crew inappropriately reduces engine thrust). This is sometimes referred to as a garden path 

solution because the person was led down a garden path by a few familiar cues. The outcome is 

a significant misunderstanding of what is happening, which can bias decisions and actions taken 

subsequently. Further, one’s understanding of the current situation can lead to a confirmation 

bias mindset (see Evans, 1989) in which only confirmatory information is sought. 

The interface designer can reduce the likelihood of incorrect interpretations by providing higherlevel representations of the system’s (or airplane’s) performance; these may include graphical 

depictions or simple textual messages about the system. If the pilot must rely on low-level 

indications of engine performance, it is easier to selectively attend to indications that can be 

misleading (or may not form a complete picture of the situation). 

Technology should be used to determine consequences and reason about machine behavior. 

There has been a great deal of study of mental models (e.g., Gentner and Stevens, 1983; Oakhill 

and Garnham, 1996) in systems operation. A mental model is a person’s mental representation 

of a system or device that allows him/her to reason about how it will behave or respond to 

inputs. Thus, if one has a mental model of the fuel system and engines (or some other airplane 

system), one can be told of a fault and use the mental model to step through the system effects. 

The outcome is an understanding about how well the system can perform and how the airplane 

mission may be affected (e.g., cannot make intended destination). 

Unfortunately, as mentioned earlier, humans have limits in their capacities for this type of

reasoning. Mental models are, therefore, limited and often inaccurate in some way. Further, the 

reduced emphasis on systems training in the last 10 years has left pilots with less well-developed 

mental models of airplane systems. There are numerous examples where pilots apparently made 

significant errors in understanding faults and anticipating outcomes. These cases suggest that 

humans should be supported in thinking through from faults/failures/reconfigurations to 

consequences for flight operations. 

Electronic checklist systems collect notes from all executed nonnormal checklists to give the 

flight crew a compiled set of effects in the appropriate (approach/before landing) normal 

checklist. A potentially useful enhancement would be to integrate these consequences around 

mission-related capabilities, e.g., areas such as maneuvering, range, or landing. In this way, the 

computational power of the automation can aid the flight crew in understanding how their 

mission is affected, and the relevant information gets accessed by the crew when they need it. 

Technology should be used to track goals and support task management. A number of accidents 

and incidents have demonstrated that flight crews sometimes fail to manage tasks well. There 

are many compelling historical examples of poor flight crew resource management. Typically, 

4-109
in these cases, flight crews lose sight of the big picture (sometimes referred to as losing situation 

awareness) and inappropriately spend their resources on lower-level tasks when more critical 

tasks require attention. Certainly, CRM training is one approach to making crews better at 

managing with the big picture in mind. However, the flight deck interface might take on more of 

this role as well by providing enhanced representations of current status. 

The flight crew needs to see clearly what problems exist and be able to assign priorities 

accordingly. As before, the interface needs to show system status effectively (e.g., engines or 

the fuel system) and its effects on mission completion. Flight crews should not have to generate 

these higher-level accounts on their own; it is time-consuming, error-prone, and a poor allocation 

of human effort. 

Technology should be used to identify and locate appropriate procedures. After the flight crew 

is aware of a problem and understands the nature of the problem, the next thing needed is quick 

and reliable access to the appropriate guidance—that is, the nonnormal procedure. In Boeing’s 

recent discussions with airlines, it was found that flight crews sometimes have difficulty getting 

the correct checklist when working with paper checklists (e.g., because of the organization of the 

document; note that the B777 Electronic Checklist has removed this concern). The organization 

of the paper checklists and the link between alert messages and checklists is important to getting 

appropriate/desired crew response. Boeing continues to focus efforts in this area. The point here 

is that technology (through interface design) offers more powerful means for guiding flight 

crews to the appropriate procedure/response. 

Technology should be used to guide detailed sets of actions. Most flight deck procedures are 

driven by checklists, which is a rule-based form of performance (Rasmussen, 1986). The 

advantage of a rule-based approach, in which guidance is written down in detail to be followed 

by the flight crew, is that Boeing pilots and system engineers have already thought through the 

types of failures that can occur and the appropriate response to each. Many actions need to be 

performed exactly as specified, and the order of actions can be important. It is not possible for 

pilots to carry such detailed guidance in their heads and reproduce it consistently and accurately. 

The appropriate role of technology in supporting the flight crew is to provide the detailed 

guidance (since it cannot be remembered accurately) and to aid the crew in adapting that 

guidance to the current conditions. The problem with developing a rule-based approach is that 

the people who write the procedure cannot anticipate all potential situations that might arise. 

The role of the pilot is to take the guidance and ensure it is applied appropriately for the 

situation. Technology can support this adaptation by making clear the intent of each step of the 

procedure and by showing the intended system, airplane, and mission consequences of the 

procedure. 

Technology should be used to convey intent of the agents. On modern flight decks, there are 

typically three agents who can control the airplane and its systems: captain, first officer, and the 

automation (autopilot, autothrottle, and automated system logic). Each agent can have the 

authority to make virtually all control inputs. It is then the role of the other agents to monitor the 

controlling agent—PF or automated agent flying—and ensure that it is performing as expected. 

An important shift in flight crew training is that the PNF is referred to as the pilot monitoring 

(PM) (Helmreich, Klinect, and Wilhelm, 1999). It is the PM’s role to understand what the PF is 

4-110
intending to do and monitor for deviations or errors in executing that intent. The argument is 

that it is easier for the PM to detect and correct inadvertent errors than the pilot who made those 

errors, the PF. This applies equally well to cases where the automation is flying, i.e., the 

appropriate role of the human crew is PM. 

In this framework, it is critical that the PM 

• know and understand the controlling agent’s intent and 

• understand how to monitor the execution. 

In the case of the automated agent (autopilot), there is evidence that the flight crew can fail on 

both accounts: they may fail to get, or be unable to get, sufficient feedback from the flight deck 

interface regarding what it intends to do (e.g., Sarter and Woods, 1997) and fail to monitor, or be 

unable to monitor, effectively, even when the intent is understood (Mumaw, et al., 2000). 

In current flight decks, it is the responsibility of the flight crew to convey intent through 

briefings, formal callouts/procedures, or more casual communications. If the PF fails to convey 

intent, the task of the PM becomes much harder. Flight deck technology might be used to 

convey intent. In the case of the automated agent, the flight deck interface could convey what 

tactical targets it is using (i.e., altitude or airspeed) and how it will achieve those targets (e.g., 

Hutchins, 1993). Or when automated system control processes are initiated and it is important 

for the crew to have an awareness of those changes (e.g., changes that might suggest a fuel leak 

is occurring), the interface could make those processes more visible. Similarly, there may be 

ways for the interface to reveal the intent of the human PF in tactical flying or in systems 

management. 

Technology should be used to support smooth task completion. Flight operations is often 

reactive to the needs of others, and flight crews can be distracted or interrupted by ATC, the 

airlines operation center, or the cabin staff. These interruptions can come while the flight crew is 

trying to accomplish some procedure, and the crew is responsible for successfully returning to 

and completing the interrupted task. Recent research (Dismukes, Young, and Sumwalt, 1998) 

has described how crews can fail to overcome these distractions. Checklist steps can be skipped, 

entire checklists can be forgotten, or other pilot actions can be lost (e.g., setting altimeter). 

Flight deck technology can reduce the potential effects of this failure in prospective memory by 

helping the flight crew track what is being done or by alerting items that are not done. The B777 

Electronic Checklist provides certain useful features in place keeping and tracking completed 

checklists. Airplanes also have the takeoff configuration warning system that alerts the crew 

when the airplane is not properly configured for takeoff. Ideally, these types of features can be 

implemented more broadly to help crews ensure that tasks and procedures are completed 

successfully. 

Technology should be structured to support effective and efficient execution of common tasks. 

Currently, a number of flight operations tasks require the flight crew to pull together information 

4-111
from a number of sources; an example is diversion planning where flight crews need to consult 

FMC performance data, get information from their airline operations center, assess airplane 

capabilities, etc. There can be a significant workload in gathering and integrating data to support 

this type of decision-making. Flight deck technology can better support performance by 

bringing all of the relevant information together to support these types of critical tasks. 

As flight deck technology progresses, it will become more possible to bring data together around 

tasks instead of relying on the flight crew to integrate and interpret information from multiple 

sources. The result will be lower workload and better-informed decisions. 

4.3.5.3.2 Overview of the Role of Humans and Machines. 

The foregoing was intended to provide an overview of the types of activities that humans do 

poorly. Generally, humans 

• have limited attention and working memory. They focus on a small set of items where 

they expect useful information to be. Attention becomes more focused when stress 

increases, and they can only keep a handful of items in mind at any one time. New 

information can bump other information out. 

• can be overloaded in one modality. The visual system can only focus in a small area and 

information is more likely to be perceived when it comes through a different modality, 

such as aural or tactile. 

• have limited reasoning abilities. Their understanding of complex systems is flawed, 

incomplete, and contains misconceptions. They can only make limited manipulations in 

working memory.

• can overgeneralize and leap to incorrect conclusions. Further, a pilot’s current 

understanding can bias him/her to seek only confirmatory evidence from the set of 

indications available. They can become fixated on a problem that may be minor in the 

larger scheme. 

• have limits on the detail that can be recalled from long-term memory. Precise 

instructions can be forgotten, and it is better to rely on written down instructions. 

Technology—if one hopes to preserve the human as the primary authority on the flight deck—

can be used to extend human capabilities and support flight crews in achieving mission 

objectives. Generally, the role of technology should be: 

• Monitoring for meaningful changes in system and airplane performance and making 

those changes known to the flight crew. 

• Guiding attention through either salient information in the field of view or attracting (or 

directing) attention to an area where important information can be found. 

4-112
• Reducing workload by reducing the need for mental integration and manipulation by 

organizing data around meaningful events and system descriptions (not simply presenting 

data from individual sensors), by tracking individual system faults through to airplane 

effects, and by organizing data around important flight operations tasks and decisions. 

• Support priority setting and task management by providing higher-level descriptions of 

airplane systems and functions (airplane capabilities) so that flight crews can identify the 

most important issues quickly and track how well those are being managed. Further, 

these high-level descriptions can potentially prevent incorrect interpretations of the 

current situation. 

• Guiding flight crews from awareness through to understanding the problem to prescribed 

actions (procedure) for that problem. 

• Capturing and conveying intent so that the pilot(s) who are not controlling the airplane or 

airplane systems can monitor execution more effectively and coordinate their own 

activities better. This reduces the need for explicit communication between agents, 

which may not always be done well, given the potential distractions and pitfalls in the 

environment. 

The focus in the use of technology should not just be in reducing errors (either through 

eliminating them or making them more easily detected) and reducing workload. It is equally or 

more important to understand the flight crew’s tasks and support the skillful and efficient 

execution of those tasks. 

4.3.5.3.3 Data Versus Information: A General Guideline. 

In the development of indications, an important distinction must be made between data and 

information. The two terms are defined as follows. 

Data refers to a reading from an airplane sensor or control, e.g., airspeed, altitude, thrust lever 

position, and flap position. Note that the value may be processed in some way after being 

sensed. 

Information, on the other hand, places data in context to support a task; that is, data are 

integrated with other data tied to a task. Context can include reference values (e.g., thrust 

reference limit, V1 or VR), thresholds (e.g., red-line limit or operating limit, flap placard speed), 

expected values (e.g., expected EPR for current conditions), or other parameters that change an 

expected value (e.g., appropriate configuration of systems is contingent on whether it is prior to 

or after engine start). 

Thus, information is created by placing data in context; however, information is not useful unless 

it supports some flight crew task. A primary goal of interface design is to integrate data and 

appropriate context to guide pilots in decision-making and control actions (flight control or 

airplane system control). Another possibility is that the interface supports better understanding 

4-113
of the current state of the airplane or an airplane system, which eventually supports decisionmaking and control tasks. 

Broader design guidelines are presented in appendix C, which provides a description of pilotcentered design principles and also discusses Rasmussen’s performance classification scheme

(skill-, rule-, and knowledge-based). 

4.3.6 Indication Ideas. 

The foregoing has identified several considerations regarding engine indications. They typically 

• are located in an area where the flight crew may not notice subtle changes and 

malfunctions, therefore, require either a salient presentation or an alert from the EICAS 

to be reliably detected. 

• are at the level of individual parameters only. 

• show only the current value (when behavior over time may be of interest). 

If these indications remain as they are (individual engine parameters on the upper EICAS), there 

are two areas where enhancements could be considered: trend information could be added to 

capture behavior over time and differences between engines could be made more salient. 

For the first issue, behavior over time, there are two reasons to add this type of information. 

First, sometimes changes are transient and may not be fully observed. Because the flight crew is 

not monitoring the engine indications continuously, transient fluctuations may be missed. If 

those transient variations can be captured within the indication, the flight crew can extract 

information that would otherwise be lost. Second, the pattern of the behavior may reveal 

something about the nature of the malfunction. Further analysis and validation is required to 

determine whether this type of information is valuable enough to include in the design of 

indications. 

Figures 4-17 and 4-18 offer some ideas on how trend/history information might be added to the 

current indications. Figure 4-17(a) shows a traditional trend display that might be used in a 

process control setting. It shows current value with the diamond along the scale, and shows the 

parameter history over the previous 3 minutes. Figures 4-17(b) and 4-17(c) show variations on 

that indication style that summarize the trend over a time period. Figure 4-17(b) uses a bracket 

to indicate the range and minimum and maximum values of the parameter’s variation over the 

previous 3 minutes. Figure 4-17(c) captures the same information but also indicates the 

percentage of time spent in a range of values. The rectangle indicates the range that the 

parameter has been in most of the previous 10 minutes, but the T on the top and the bottom

indicate that there have been transient spikes outside of that range. Therefore, this indication 

separates the full range of variation over the 10-minute period from the range that better 

characterizes its value during that time. This type of display also helps show how stable the 

parameter has been. 

4-114
3:00 2:00 1:00

(a) (b) (c)

FIGURE 4-17. EXAMPLES OF PARAMETER INDICATIONS SHOWING HISTORY 

Figure 4-18 shows how these concepts might work in the round-dial format. Figures 4-18(a) and 

4-18(b) show a method for laying the range of parameter variation on top of the current 

indication, either as a shadowy pie wedge or as an arc well inside the edge of the round dial. It is 

important that neither indicator interferes with the ability to see the current value for the 

parameter. 

Regarding the latter area of consideration, current engine indications appear to be optimized 

more for getting information about each engine than about comparing the values across engines. 

As mentioned, a major contributor to health monitoring is comparing parameter values or 

behaviors across engines. There are currently no data on how well pilots can detect differences 

across engines. 

1.222

1.320

1.222

1.320

(a) (b)

FIGURE 4-18. PARAMETER INDICATIONS SHOWING HISTORY WITH THE 

ROUND-DIAL FORMAT 

Figures 4-19, 4-20, and 4-21 offer three ideas on how indications might be modified to make 

differences across engines more easily detected by showing the difference directly. Figures 4-19 

and 4-20 show a vertical format, and figure 4-21 uses a horizontal format. In each case, the 

supplemental indication shows that the left engine is at a higher setting than the right engine. In 

figure 4-19, the amber band extends beyond the first threshold, which is there because not all 

4-115
differences are meaningful. Figure 4-20 uses a similar idea, but with arrow indicators. The 

difference would have to be above the first threshold to be important. A second threshold is 

shown above that would turn red when exceeded. An L is placed above the engine difference 

bar to make more clear which engine is operating at a higher value. This provides guidance to 

the pilot for taking action on the left thrust lever. Further analysis and validation is required to 

determine whether this type of information is of benefit, and if so, how to best implement it in 

indications design. 

1.222

1.320

1.082

1.320

L

FIGURE 4-19. EXAMPLE OF A DIFFERENCE INDICATION, 

VERTICAL BAR FORMAT 

1.222

1.320

1.082

1.320

FIGURE 4-20. EXAMPLE OF A DIFFERENCE INDICATION, 

VERTICAL ARROW FORMAT 

1.222

1.320

1.082

1.320

FIGURE 4-21. EXAMPLE OF A DIFFERENCE INDICATION, HORIZONTAL FORMAT 

4-116
4.3.7 Summary and Recommendations. 

This review of existing and alternative engine indication concepts has described known issues, 

research on specific issues, and broader human factors design principles. The following are 

findings that can be extracted from this work. 

1. Current engine indications: 

• 

• 

• 

• 

• 

• 

The primary method for providing information to the flight crew about the 

engines is through indications that represent individual, sensed parameters. This 

is due to the evolutionary nature of flight deck interface design, earlier technology 

limitations (which may no longer apply), and FAA requirements. 

Engine indications are used to support engine performance monitoring and health 

monitoring (which includes managing nonnormals). 

Primary engine indications are continuously displayed and are part of routine 

scanning (by procedure). Secondary indications may be on selectable displays 

(not always displayed) and are not part of a pilot’s routine scan (by procedure). 

The fuel system is represented by either a system synoptic on a display or by a 

control layout synoptic on the overhead panel. Through these, the flight crew 

gets feedback about the system configuration and component (e.g., pump and 

tank) status. 

Some engine indications use EICAS messages (or equivalent alerting) when an 

exceedance occurs; for the others, a pilot must detect a change to the indication 

(e.g., a change in color) when an exceedance occurs. In all cases, variation from

the expected value that does not cross a parameter threshold (but may suggest 

degradation) is not accompanied by any salient change in the indication and is 

difficult to detect. 

2. Detecting deviations: 

The following issues regarding detection were identified using the current engine 

indications: 

− Because EICAS messages are not used for all engine parameter 

exceedances, pilots must rely in some cases on detecting changes in the 

appearance of engine indications. 

− Research suggests that pilots spend only 1%-2% of their time monitoring 

the upper EICAS display and, therefore, may not see changes to engine 

indications. 

4-117
− Other changes, such as a thrust asymmetry, can be difficult to detect 

because they may be masked by automation (that is, it may be clear that an 

asymmetry exists but the cause of the asymmetry may be difficult to 

determine). Also, indications may change in more subtle ways. 

− Changes within the normal range (i.e., not exceeding the threshold) can 

indicate slow degradation in engine performance but are difficult to detect. 

• 

• 

• 

• 

• 

• 

• 

Several researchers have proposed indications designed to make deviations more 

easily detected for some PSMs. This work relates to (for some parameters) the 

potential difficulty of detecting (in a timely way) deviations around the expected 

value, even when that deviation exceeds a threshold. 

In research on engine indications, the primary means for enhancing the detection 

of parameter deviations have been 

− using EICAS alerting messages and 

− building indications that show deviation from an expected parameter value 

(based on an engine model). 

3. Understanding engine malfunctions: 

While a number of researchers have focused on solutions to improve detection of 

parameter exceedances, the larger issue is that flight crews may have difficulty 

interpreting these indications to arrive at a correct understanding of the engine 

state. For example, flight crews can have difficulty knowing when conditions 

such as engine surge versus severe engine damage exist, or flight crews may not 

know what type of action to take in response to conditions such as engine 

degradation or engine vibration. 

Even when engine state is not well understood, flight crews usually take an action 

that maintains a sufficient level of safety; a failure to detect in a timely way and 

correctly diagnose rarely leads to a UCR and a bad outcome. The PSM+UCR 

analysis suggests that accidents and incidents might be further reduced by 

addressing this issue. 

Only one researcher has put forward new ideas on the level of engine 

representation. 

Improving the flight crew’s understanding may require representing engine state 

at a higher level than individual parameters. 

4. Guidance to a response: 

For some malfunctions, crews are guided to a nonnormal checklist that provides a 

clear prescription for understanding the PSM and responding. For others, 

4-118
guidance may be difficult to find because there is not a clear or simple cue that 

refers to a response (or there may not be sufficient time to interpret the indications 

correctly and respond). Specifically, the flight crew has to determine that an 

unannunciated checklist should be executed. 

• 

• 

• 

• 

• 

For potential benefit, the indication of engine state could also make clear if an 

engine is good (or indicate what level of functioning it has) to prevent pilots from

taking an inappropriate action on a good engine. This would require an explicit 

indication of engine state. 

5. Human factors guidelines: 

Several levels of human factors guidance have been identified and described: 

− High level—for organizing flight deck interface support for engine-related 

tasks. 

− Mid level—for identifying the types of support the flight deck interface 

should provide to the flight crew. 

− Low level—for developing effective indications. 

Indication enhancements should address both performance-monitoring tasks and 

health-monitoring tasks (including managing nonnormals). 

The following recommendations are broken out into short-term, long-term, and research and 

development (R&D). 

1. Short-term recommendations (current fleet enhancements): 

For cases where the propulsion engineers can reliably detect PSMs with existing 

sensors, create a method for alerting the crew to the PSM, then for improving 

flight crew understanding. 

− Either indications that are more closely related to revealing engine state 

changes or 

− Directly annunciate engine state changes. 

In both cases, these annunciations or indication changes should also be supported by 

linking them to a central alerting function such as EICAS. 

Evaluate how well flight crews can detect differences across engines, and assess 

the value of indication enhancements to make cross-engine differences more 

salient. 

4-119
• 

• 

• 

• 

• 

Assess the value of methods for informing the flight crew when an engine is a 

good engine to prevent the flight crew from taking actions on the wrong engine. 

2. Long-term recommendations (future fleet improvements): 

Assess the value of more integrated engine displays for future flight decks. 

Assess an approach that moves beyond indications tied to individual parameters 

in order to support more automated health monitoring. If possible, get FAA 

support to use interface real estate for presenting a more integrated view of the 

engine instead of engine parameters. 

Determine if there is an operational benefit to specific indications that 

− better reveal dynamic behavior/trending/history and 

− serve as task-oriented displays (and for which tasks). 

3. R&D recommendations (over the next 2 years): 

Work with the propulsion system engineers to characterize engine malfunctions—

that is, understand how the current available parameters behave during known 

PSMs. Focus on engine states for which flight crew actions are needed (actions 

may be immediate or tied to deferred decision making). 

When the propulsion engineers identify areas where they are unable to reliably 

detect a PSM, but there may be benefit to awareness that engine performance is 

degrading, develop a method for informing and involving the crew. Specifically, 

develop a monitoring aid that allows the crew to monitor engine performance 

more closely when engine behavior is suspect/uncertain. Further, develop 

procedures for guiding flight crew actions when there is uncertainty. 

4.4 NONCOMMERCIAL AIRCRAFT TECHNOLOGY SURVEY (TASK 6.1). 

Under task 6.1, Boeing surveyed noncommercial aircraft engine display and indication 

implementations, and documented noncommercial aircraft PSM indications and annunciations. 

The objective was to identify existing noncommercial indication and annunciation/alert 

implementations with potential for commercial aircraft flight deck application to address UCR to 

certain PSM. 

4.4.1 Task 6.1 Objective and Goal. 

The principal research objective was to evaluate PSM+ICR events, identify contributing factors, 

assess the detection and prevention potential of PSM annunciations, and establish a framework 

for understanding UCR to PSMs. The principal goal was to promote understanding of these 

events and develop recommendations pertaining to propulsion system sensing and flight deck 

indication in general, and PSM detection and flight deck annunciation in particular. It was 

intended that the recommendations transcend specific aircraft models, design, and operational 

philosophies to the maximum extent possible and practicable. As part of this overall research 

4-120
effort, a noncommercial technology survey of propulsion indications, annunciations, and alerts 

was conducted to identify existing engine indication and PSM annunciation precedents and 

supporting technology of potential value and application. This report describes that effort and 

documents the results. 

4.4.2 Task 6.1 Overview/Background and Methodology. 

The noncommercial technology survey consisted of a survey of in-service and developmental 

noncommercial turbine engine-powered aircraft. The survey objective was to identify existing 

precedents and potential concept and technology transfer in the following areas: 

• Engine indications and malfunction annunciations 

• Flight crew actions and procedures 

• Automated engine monitoring and control functions 

From a candidate list of approximately 24 noncommercial turbine engine platforms, eight aircraft 

were selected for in-depth review and are listed below. The aircraft selected for the survey 

represent a cross section of current generation aircraft types, which are predominately military 

aircraft. This is particularly relevant to the issue of PSM+ICR because military aircraft missions 

impose unique and additional crew workload requirements. Mission-specific tasks add to the 

basic workload associated with primary aircraft control, navigation, and communication. The 

military mission is often a single pilot, high workload, and time-critical environment. This 

environment allows little time for basic airplane systems operation or accommodation and is 

typical of PSM+ICR events. In both the military mission and commercial environments, 

airplane system malfunctions in general, and propulsion system malfunctions in particular, must 

be quickly and correctly identified, understood, and accommodated. 

• 

• 

• 

• 

• 

• 

• 

• 

F15E 

F18E/F 

F22 

AV8B 

C17 

V22 

AH64D 

Gulfstream V 

Airplane system, flight operation, and procedure manuals were reviewed for each aircraft. These 

reviews were supplemented with additional information provided by system engineering, flight 

operations engineering, and pilot contacts. 

In general, for each aircraft, the engine controls, indications, annunciations/alerts, and normal 

and nonnormal operating procedures were reviewed. In particular, the survey sought to: 

• identify the parameter(s) and means by which engine thrust/power is normally controlled. 

This included the Head Up Display, Head Down Display, and mechanical gage 

indicators. 

4-121
• focus on Engine Fail/Subidle, Surge, Stuck Throttle, High Vibration, and Thrust 

Asymmetry PSMs and symptoms. Emphasis was placed on the differences and potential 

technology transfer in these areas and associated nonnormal indications, 

annunciations/alerts, and procedures. 

Each aircraft review produced the following: 

• A top level description of aircraft and engine type 

− Aircraft description transport (fighter, business, etc.), sector (military, civilian, 

etc.), status (design, prototype, testing, in service), and generation (old /new) 

− Engine description, e.g., number, location, engine type, controller type (FADEC, 

Non-FADEC, supervisory) 

• An overview/description of normal engine instruments/indications and controls 

− Type (mechanical, LCD, display, etc.) 

− Engine Parameters 

• 

• 

Specific parameters available full- versus part-time, e.g., N1, EPR, EGT, 

N2, N3, fuel flow, oil pressure, oil temperature, vibration, other 

Any unique or unusual parameters or concepts 

• Primary Thrust Control 

− What parameter(s) used and how used 

− What control devices used and how used 

− What thrust control parameter features, e.g., limits indications, commanded 

versus actual indications, graphical versus digital, unique or unusual. 

An overview/summary of the aircraft alerting system, and the nonnormal annunciations 

(indications and alerts) and procedures follows: 

• Engine Fail Low (flameout or subidle) 

• Surge 

• Stuck Throttle (i.e., throttle or thrust split) 

• Engine Failed Fixed Thrust 

− Thrust Shortfall (actual thrust less than commanded thrust) 

− Overthrust (actual thrust greater than commanded thrust) 

4-122
• High Vibration 

• Thrust Asymmetry

• Engine Fail High (speed or other parameter exceedance) 

• Any unique or unusual annunciation or procedure relevant to Powerloss, Surge, or Thrust 

Asymmetry.

The following sections describe the aircraft and engines surveyed, the survey results, and 

document survey conclusions and recommendations. Because of the potentially sensitive and 

proprietary nature of the aircraft and information involved, the detail aircraft write-ups are not 

included in this report. In addition, the tabular summaries of Engine Parameters, 

Annunciations/Alerts, and Potential Transfers of Precedence and Technology are not airplanespecific. 

4.4.3 Aircraft and Engine Descriptions. 

The following paragraphs describe the aircraft and engines surveyed. 

4.4.3.1 F15E. 

The F15E is a twin-engine United States Air Force (USAF) military single- or dual-seat, highperformance, supersonic, all-weather fighter. The current model is fourth generation and is 

currently in service. 

The engines are P&W F100-PW-229 turbofan engines with afterburners. The -229 engine is 

controlled by a Digital Electronic Engine Control. The engines are internally mounted with sidemounted air inlets. 

The primary and secondary engine indications are display-based, and the aircraft has a displaybased centralized alerting system. A master caution light is provided. Aural alert tones and 

voices are provided. 

4.4.3.2 F18E/F. 

The F18F is a twin-engine U.S. Navy military single- or dual-seat, carrier-based strike fighter. 

The model is later generation and is currently in service. 

The engines are GE F414-GE-400 low by-pass, axial-flow, twin-spool turbofans with afterburner 

(AB). The three-stage fan low-pressure (LP) compressor and the seven-stage high-pressure (HP) 

compressor are each driven by a single-stage turbine. Engine operation is controlled by a 

FADEC. The engines are internally mounted with side-mounted air inlets. 

The primary and secondary engine indications are display-based, and the aircraft has a displaybased centralized alerting system. A master caution light and aural are provided. Aural alert 

tones and voices are provided. 

4-123
4.4.3.3 F22. 

The F-22A Raptor is a twin-engine USAF military single-seat, all-weather tactical fighter. The 

current model is new generation and is currently in testing. 

The engines are F119-PW-100 twin-spool, counter-rotating, afterburning engines equipped with 

two-dimensional convergent/divergent nozzles. The engines provide thrust levels sufficient to 

achieve supersonic flight without use of afterburners. The engines are internally mounted with 

side-mounted air inlets. 

Each engine is controlled by two FADECs. The FADECs control engine operation from engine 

start to maximum AB power with protection for critical limits. Each engine also incorporates a 

comprehensive engine diagnostic unit to perform engine diagnostics and health management. 

The primary and secondary engine indications are display-based, and the aircraft has a displaybased centralized alerting system. TBV: master warning/caution lights and aural alert tones and 

voice are provided. 

4.4.3.4 AV8B. 

The AV-8B Harrier is a single-engine United States Marine Corp (USMC) military single-seat, 

transonic attack aircraft. The vertical/short takeoff and landing aircraft is currently in service. 

The engine is a Rolls-Royce F402-RR-406A, F402-RR-406B, F402-RR-408, F402-RR-408A, or 

F402-RR-408B dual-spool, axial-flow, turbofan engine with thrust-vectoring exhaust nozzles. 

One of the spools is a three-stage, low-pressure compressor (fan) driven by a two-stage, lowpressure turbine, and the other is an eight-stage, high-pressure compressor driven by a two-stage, 

high-pressure turbine. Each spool is independent of the other, but they are coaxial and, to 

minimize gyroscopic effect, they counter-rotate. 

The engine is controlled by a Digital Engine Control System (DECS). DECS is a full authority 

digital engine control system. The DECS provides engine control throughout the engine 

operating range in response to throttle position, altitude, airspeed, angle of attack, inlet air 

temperature, and aircraft configuration. The four main components of the DECS are a Pilot 

Lever Angle Assembly, two identical Digital Electronic Control Units, and a Fuel Metering Unit. 

The primary engine indications are dedicated mechanical instruments. Secondary engine 

indications are display-based. Aircraft alerting is provided by discrete warning and caution 

panel annunciators. A master caution light and aural alert tones are provided. 

4.4.3.5 C17. 

The C17 Globemaster is a four-engine USAF military long-range transport aircraft. The aircraft 

is new generation and is currently in service. 

4-124
The engines are P&W F117-PW-100 fly-by-wire turbofan engines. The F117-PW-100 is a dualspool, single-stage fan, high by-pass ratio turbofan engine. The engine nacelles are mounted on 

underwing pylons. The low-speed rotor, designated N1, consists of one fan stage, four 

compressor stages, and five low-pressure turbine stages. The high-speed rotor, designated N2, 

consists of 12 high-pressure compressor stages and 2 high-pressure turbine stages. The 6- 

through 10-stage stator vanes are variable angle vanes that are used to improve starting 

characteristics and prevent compressor surge. The combustion section of the engine is comprised 

of a single-annular burner with 24 injectors for rapid combustion. The engine inlet is a fixed 

geometry inlet. 

Engine operation is controlled by a dual-channel EEC, an electromechanical fuel control, a 

throttle, and a fuel shutoff valve. The EEC provides a full authority thrust management system, 

which has the following features: repeatable thrust settings, thrust rating control, engine limit 

protection, reverser control, continuous oil system, and engine component monitoring for built-in 

test and annunciation. 

The primary and secondary engine indications are display-based, and the aircraft has a 

centralized alerting system. Master warning/caution lights and aural alert tones and voices are 

provided. 

4.4.3.6 V22. 

The V-22 Osprey is a two-engine USMC military tilt-rotor, multipurpose transport aircraft. The 

aircraft is new generation and is currently in testing. 

The aircraft is powered by two Rolls-Royce Allison AE1107C turboshaft engines. An engine is 

mounted in each wingtip nacelle. Each engine consists of four major assemblies: 

• Torquemeter assembly, which transmits engine output power to the Proprotor Gearbox 

(PRGB) 

• Gas generator assembly, consisting of the compressor assembly, the combustor assembly, 

and the gas generator turbine 

• Power turbine assembly, which converts gas energy into shaft power to drive the PRGBs 

• Accessory drive gearbox, which drives the Fuel Pump Metering Unit (FPMU), engine oil 

pump and regulator assembly, and a Permanent Magnet Alternator 

Each engine is controlled by a separate power control system consisting of two FADECs and an 

FPMU. 

The engine indications are display-based, and the aircraft has a centralized alerting system. 

Master warning/caution lights and aural alert tones and voices are provided. 

4-125
4.4.3.7 AH64D. 

The AH64D Apache is a two-engine, tandem seat U.S. Army military four-blade, single-rotor 

helicopter. The aircraft is new generation and is currently in service. 

The aircraft is powered by two T700-GE-701 turboshaft engines mounted in engine nacelles on 

each side of the fuselage. Each engine is controlled by a DEC and has a conventional fuel 

control system. 

The primary and secondary engine indications are display-based, and the aircraft has a 

centralized alerting system. Master warning/caution lights and aural alert tones and voices are 

provided. An electronic checklist for nonnormal engine conditions is provided. 

4.4.3.8 Gulfstream V. 

The Gulfstream V is a two-engine General Aviation Business long-range, high-altitude aircraft. 

The aircraft is new generation and is currently in service. 

The engines are Rolls-Royce BR 700 turbofan engines. The BR 700 is a two-spool, single-stage 

fan, ten-stage compressor, two-stage HP and LP turbine, high by-pass ratio turbofan engine. The 

engines are aft fuselage-mounted. 

Engine operation is controlled by an FADEC. The FADEC provides the necessary engine 

control functions and operates in association with appropriate aircraft subsystems. The dualchannel EEC is the major part of the FADEC interfacing between the aircraft and the engine, and 

provides a means of controlling the engine. 

The primary and secondary engine indications are display-based, and the aircraft has a 

centralized alerting system. TBV: master warning/caution lights and aural alert tones are 

provided. 

4.4.4 Summary of Survey Results. 

Tables 4-38 and 4-39 summarize the cross-aircraft survey of engine indications, parameters, and 

annunciations (on indications and as alerts). 

4.4.5 Potential Precedent and Technology Transfers. 

The following sections summarize the cross-airplane potential for transfer of noncommercial 

precedence and technology. The summary is not airplane-specific. Seven general categories 

were identified and specific implementation precedents and technologies within each category 

are listed. 

4-126
TABLE 4-38. SURVEY AIRCRAFT NORMAL ENGINE PARAMETER INDICATIONS SUMMARY 

N1 and/or 

Rotor EPR EGT N2 Oil P Oil T Fuel Flow Vibration Other 

F-Digital and Graphic P-Digital and Graphic 

N/A F-Digital and F-Digital and 

Graphic Graphic 

P-Digital and Graphic 

F-Digital P-Digital 

P-Digital P-Digital N/A P-Graphical Oil Qty

P-Digital and Graphic 

F-Digital and Graphic P-Digital 

P-Digital and Graphic F-Digital and Time if >MCT 

P-Digital and Graphic 

P-Digital and Graphic 

P-Digital and Graphic 

F-Digital Total P-Digital (each eng) 

N/A F-Commanded EPR

F-Standby Digital display of N2, EPR, EGT 

and N1 

F-Digital and Graphic 

N/A F-Digital and P-Digital

Graphic 

F-Digital

P-Digital 

P-Digital P-Digital N/A

P-Digital N/A F-Digital F-Digital

P-Digital 

F-Digital P-Digital F-Digital P-Digital P-Digital Engine Status 

P Digital Thrust (%Takeoff) P-Digital Vibration for Fan and Core P-Digital Compressor discharge pressure and 

pressure ratio 

P-Digital Throttle Lever Angle 

P-Digital N/A F-Digital

P-Digital and Graphic 

F-Digital P-Digital and Graphic 

P-Digital and Graphic 

N/A P-Digital P-Digital F-Graphical and Digital THRUST Indication 

P-Digital Turbine Blade TempP-Digital Burner Pressure P-Digital ENG Airflow P-Digital Inlet Air TempP-Digital Oil QtyAuto Display of Part-Time Engine Indications for Engine Malfunction 

F-Digital N/A F-Digital F-Digital N/A N/A F-Digital N/AN/A N/A F-Digital

P-Digital 

F-Digital P-Digital 

F-Digital P-Digital 

N/A F-Digital

P-Digital 

N/A 

F-Digital and Graphic 

F-Digital and Graphic 

F-Digital and Graphic 

F-Digital and Graphic 

F-Digital F-Digital F-Digital 

and Graphic 

F-Digital N1 & N2 

4-127

F = Full-Time. P = Part-Time
TABLE 4-39. SURVEY AIRCRAFT NONNORMAL ANNUNCIATIONS SUMMARY—INDICATIONS AND ALERTS 

Engine Fail Low 

(Subidle/Flameout) 

Thrust 

Shortfall 

Engine 

Surge/Stall 

OverThrust Engine Fail High (Exceedance) Thrust Asymmetry High Vibration High EGT Other 

A-Flameout A-Shutdown I-Subidle rpm amber 

A-Stall I-Red analog and 

digital rpm

I-Digital I-Red analog and 

digital EGT 

A-Degraded Eng Op A-Loss of Eng Ctrl 

A-Eng rpm I-Thrust loss ann. I-Subidle amber analog and digital N1 

I-Thrust loss ann. 

A-Eng rpm 

I-Amber analog and digital EPR and N1 

A-Eng rpm I-Thrust loss ann. 

A-Eng Temp A-Eng Stability

(Bleed valve fault) I-Amber and red 

analog and digital EGT 

A-Flameout A-Subidle or Shutdown I-Highlight and Red digital rpm

A-Shortfall or Slow Response I-Highlight and Red digital rpm

A-Stall A-Overspeed

I- Highlight and Red digital rpm 

A-Vibration A-Eng EGT I-Highlight and Red digital Vib 

Highlight and Red digital EGT 

A-Eng Exceedance A-Eng

Exceedance 

A-Eng Temp 

I-Red analog N2 I-Amber and red 

analog and digital N1 and N2.A-Eng Exceedance 

I-Amber digital I-Amber and red 

analog and digital EGT A-Eng Exceedance 

A-Eng Fail A-Low rpm A-Eng Surge A-N2 Overspeed or 

Limiting A-High rpm 

I-Amber and red analog and digital EGT 

I-Amber digital rpm 

A-Eng Temp I-Amber digital EGT 

A-Eng Fail A-Eng Fail 

I-Amber and red analog and digital % rpm 

A-Vibration I-Amber and red 

analog and digital EGT 

4-128

I = Engine Indication or Dedicated Annunciation A = Alert Annunciation 
4.4.5.1 Engine Indication Concepts. 

• Engine Status Annunciation on ENG Display (e.g., NORM, THRUST, IDLE, 

SHUTDOWN, etc.). Research suggests such status could be provided there or in other 

more visible locations, e.g., on primary display. 

• Normal full-time color coding of rpm arc—yellow below minimum idle, green operating 

range, and red above maximum operating limit. 

• Display of acceleration time for applicable engine rpm range (e.g., idle to medium, 

medium to maximum).

• EPR thrust limit/rating label display—MAX, INT, MCT, DRT, MAN, NO RATING

displayed with digital EPR limit. 

• FADEC Unit and Channel control status—indication of which is in control. 

• Display-based fuel flow vertical indication collocated between fuel flow round-dial 

indicators. Has potential application to other parameters where quick view comparison 

of engine parameters is desired. 

4.4.5.2 Propulsion System Malfunction Indication Annunciations. 

• Nonnormal Runaway (red) and subidle (amber) rpm gage color coding. 

• Nonnormal Thrust gage color coding for any graphical round-dial gage nonnormals that 

color the dials red or amber. 

− Display of Time (a) at/over maximum thrust or (b) time remaining at/over 

maximum thrust.

− EPR tape fill and digital indication turn amber when EPR exceeds displayed limit. 

− N1 and N2 digital and graphic displays turn red when parameter exceeds limit, 

turn amber when parameter is below low limit. 

4.4.5.3 Propulsion System Malfunction Alert Annunciations. 

• Voice alert implementation concepts, (e.g., engine voice alert accompanies overspeed, 

high EGT, flameout, stall, high vibration, and other propulsion system malfunctions). 

• Time voice alert (e.g., FIFTEEN SECONDS FIFTEEN SECONDS) for critical time at 

overtemp. 

• Voice alert provided in conjunction with various fuel system configuration or nonnormal 

condition caution alerts (e.g., FUEL CONTROL FUEL CONTROL or CAUTION 

CAUTION). 

4-129
• Slow Throttle response alert (e.g., commanded and actual thrust delta). 

• Engine-specific Stall/Surge alerts. 

• Engine-specific alert for multiple different conditions—engine control, thrust 

loss/limited, fail to idle, auto shutdown. 

• Engine-specific Flameout alerts. 

• Engine-specific High Vibration alerts. 

• Engine-specific Overspeed alerts. 

• Thrust Loss caution indication in primary view of each pilot—a delta EPR (higher or 

lower) than a calculated average EPR. 

4.4.5.4 Display Management Concepts. 

• Display-based and facilitated pilot-selectable links to relevant system information. 

• Pilot-selectable display management link/connection from nonnormal alert to applicable 

system page. 

• Auto display of part-time or secondary engine parameters. 

4.4.5.5 Airplane-Level Information Display. 

• Airplane Level Information Display. Cruise data display on part-time/secondary engine 

page (e.g., range, time, etc.). 

• Bingo fuel annunciation on primary display (commercial equivalent concept(s)). 

• Total fuel flow and total fuel used calculation and display. 

4.4.5.6 Health Monitoring and Control. 

• FADEC Health Monitoring for engine surge, failure, and other malfunctions. 

• FADEC Auto Shutdown to prevent catastrophic engine failure. 

• FADEC auto stall recovery (engine will not respond to throttle commands (except OFF) 

until stall is cleared). 

4.4.5.7 Airplane Flight Control or Control Function. 

• Asymmetric Thrust Departure Prevention System. Under certain nonnormal engine 

conditions, engine thrust is automatically and temporarily equalized. 

4-130
• Normal OFF Throttle control and finger lift interlock/guard. 

• Throttle control finger lift interlock and alternative pilot force override force for 

maximum thrust. RE MD11 implementation of emergency overboost feature which 

allows the pilot to override the maximum rated thrust stop by exerting a force of about 33 

pounds (15 kilograms) to the throttle levers. This overrides the FADEC into a mode 

where thrust is limited only by burner pressure or rotor speed limits. 

4.4.6 Task 6.2 Conclusions. 

The implementation precedents, technologies, and crew interface concepts and strategies used in 

the noncommercial aircraft surveyed have practical application to commercial aircraft operations 

in the pursuit of increased safety through improved crew airplane system awareness, 

understanding, and response associated with PSM+ICR events. 

There is potential transfer of implementation concepts and supporting technologies in the 

following areas: 

• Engine Indication Concepts 

• PSM Indication Annunciations 

• PSM Alert Annunciations 

• Display Management Concepts 

• Airplane-Level Information Display 

• Health Monitoring and Control 

• Airplane Flight Control or Control Function 

4.4.7 Task 6.2 Recommendations. 

In general, it is recommended that the implementation precedents, crew interface concepts and 

strategies, and supporting technologies identified by this survey be investigated further for their 

potential application and use in commercial transport aircraft designs and operations. 

It is specifically recommended that the investigation focus on further assessing the potential 

application and use of: 

• automatic and manual display management strategies, 

• airplane-level display of engine status, thrust malfunction, and fuel information, 

• annunciation of engine subidle and other malfunctions on the associated engine 

parameter indications, 

• alert annunciations (nonvoice and voice) for engine surge, high EGT, high vibration, 

thrust shortfall, and overthrust conditions, and 

• health monitoring and engine control concepts. 

4-131/4-132
5. TECHNICAL FEASIBILITY ASSESSMENT. 

This section provides a summary of technical opinion on the feasibility of detecting various PSM 

on future airplane models. The analysis of tasks 2.1, 5.1, and 5.2 were used to identify specific 

PSM to assess detection methods. Specifically, technical feasibility of detections methods of 

PSM to support annunciation concepts designed to reduce ICR, referred to as undesired 

outcomes herein, to the PSM on existing aircraft and in new designs were addressed. Analysis 

thus far suggest means to detect Surge and Engine Fail Low (including Nonrecoverable Surge 

and Powerloss) PSM events will provide the greatest opportunity to reduce the risk of undesired 

outcomes or ICR. An important qualifier is identified from the analysis thus far in that 

performing the detection of these PSM in a time-critical part of the flight profile will not 

significantly reduce the risk of undesired outcomes. 

The work performed via subcontract for task 5.2 resulted in a detection algorithm for both Surge 

and Recoverability (Recoverable/Nonrecoverable Surge). The subcontractor concluded that the 

capture rate data for a detection algorithm must be on the same order or faster than the frame rate 

of the engine control outer control loop. Details of the engineering analysis are reported in 

appendix E. 

Technical opinions were solicited from experts in the aerospace gas turbine engine community 

on means to detect these PSM events. These opinions include informal correspondence with 

technical experts from Boeing and from two aeroengine OEMs. In general, technical experts 

agree that detection of surge is feasible. These experts question the value of an annunciation of 

every surge detected. The value identified for surge annunciation is to: 

• associate a surge PSM with the aural characteristic (the bang) of a surge. 

• identify which engine has experienced the surge. 

Further reliable and accurate detection of surge on future models will likely require improved 

sensors, in agreement with the subcontractor work described previously. 

Technical opinion on the detection of recoverability is not conclusive. When the qualification 

that this detection scheme should not be applied to a time-critical portion of the flight, the 

experts believe a reliable system is more likely. The work performed by the subcontractor for 

task 5.2 supports this position. Boeing experts identify the response rate of existing sensor suites 

as an impediment to developing robust detection systems. 

A PSM detection scheme related to the recoverability subject is the comparison of actual thrust 

to commanded thrust. The primary difficulty with this scheme is its reliance on a model of the 

engine to determine thrust. The problem is that the existing engine models are designed to 

validate minimum thrust for a nonmalfunctioning engine. The reliability of these models is not 

compatible with the ability to certify a system for determination of thrust in malfunctioning 

engines. 

5-1
Detecting Surge PSM events is considered feasible by experts in the aerospace gas turbine 

engine field. These experts are concerned with the validity of annunciating all detected surges to 

the crew. Great care must be taken in developing a highly robust system to detect 

Nonrecoverable Engine Fail Low PSM events. Robust algorithms will likely require large 

empirical databases for development and validation. Once implemented, the system will rely on 

real-time tuning with current empirical data (both fleet and individual asset). 

Further, as stated above, the reliable detection of a Surge (recoverable or nonrecoverable) is 

considered feasible. This is borne out in the implementation of surge recovery logic in the 

engine controls of modern turbojet and turbofan engines. 

5.1 PROPULSION SYSTEM MALFUNCTION CHARACTERIZATION. 

Incidents from the AIA PSM+ICR report were identified that contain representative PSMs to 

provide a basis for characterization and study of detection potential. The PSM characterizations 

were established to support discussion and assessment of detection potential and development of 

indication and annunciation strategies designed to reduce UCRs to PSMs and thereby enhance 

safety by mitigating the risk associated with such events. The representative events span the 

major categories of PSMs recommended for characterization and study: 

• Recoverable and Nonrecoverable Engine Failure (low, fixed, and high power) 

• Recoverable and Nonrecoverable Powerloss 

• Recoverable and Nonrecoverable Surge 

These categories are collector symptom categories that do not necessarily describe a root-cause 

PSM. These generalized categories provide a means to group and characterize different rootcause PSMs, to assess detection potential, and to assess the likelihood that annunciation will 

result in desired crew response. 

• Recoverable versus Nonrecoverable: The distinction between a Recoverable and a 

Nonrecoverable PSM event is whether or not the engine is able to achieve the requested 

or commanded power (typically thrust) through either engine control or crew intervention 

after the PSM. 

• Engine Fail: Engine Fail PSMs are generally characterized by either a lack of engine 

response to power lever movement or the inability to move a power lever. Definitions 

for Engine Fail PSMs are further refined into Failed Fixed, Fail High, and Fail Low 

categories. The ability of the engine system architecture and control logic or some crew

initiated procedure to accommodate the root cause determines whether an Engine Fail 

PSM is Recoverable or Nonrecoverable. 

• Failed Fixed: The inability to move a power lever is categorized as a Engine Failed 

Fixed PSM event. Additionally, an engine that does not respond to power lever 

movements is said to be failed fixed. 

5-2
• Fail High: An Engine Fail High PSM is generally characterized by nonrequested 

increases in engine spool speeds, pressures, and temperatures. The rate and magnitude of 

these changes is dependent on the power setting required for the flight condition at the 

time of the PSM. 

• Fail Low: An Engine Fail Low PSM is generally characterized by decaying spool 

speed(s) and engine temperatures. The rate and magnitude of these changes is dependent 

on the power setting required for the flight condition at the time of the PSM. 

• Powerloss: A Powerloss PSM is generally characterized by decaying spool speed(s) and 

engine temperatures. The rate and magnitude of these changes is dependent on the power 

setting required for the flight condition at the time of the PSM. In the Engine Fail and 

Powerloss PSM categories, thrust asymmetry may be experienced as the engine with the 

PSM runs down while the other engine(s) produce thrust at a significantly different level. 

The thrust asymmetry will generally include an engine-to-engine difference in displayed 

parameters (EPR, N1, N2, EGT, etc.) and may include an offset or split in thrust lever 

position. 

• Surge: A Surge PSM is generally characterized by an instantaneous noise, flame visible 

at the engine inlet, and a transient variation in engine parameter indications (EPR, N1, 

N2, EGT, etc.). Depending on the power setting, a Surge event may exhibit a transient, 

perceptible vibration and lateral acceleration. Recoverable versus Nonrecoverable Surge 

PSMs are generally differentiated by a sustained increase in vibration and the engine 

failing to a low/no power (wind-milling). 

This section provides the supporting data that result in a precise definition of these categories of 

PSM events. PSM events categorized as LOC, Other, or SDTGE were identified as being linked 

with increased hazard risk. Specifically, Powerloss is the term used for 19 events and Surge is 

used to describe 18 of the events in the PSM+ICR report. Further, some of the Surge events are 

associated with a Powerloss condition. The following terms are used: 

• Category: A grouping of PSMs that produce a similar propulsion system or airplane 

system-level response. 

• Definition: A more detailed description of a PSM category. The definitions may break 

the PSM category into subcategories. 

• Characterization: A listing of specific parametric attributes of a PSM. This is the most 

detailed description of a PSM category or subcategory. 

The following observations were made: 

• 73% of the PSM+ICR data falls into the Nonrecoverable Engine Fail Low, 

Nonrecoverable Powerloss or Surge (Recoverable or Nonrecoverable) categories. 

5-3
• Powerloss and Engine Fail Low events are typically associated with the hard failure of 

some component that causes the powerloss. This being the case, Powerloss and Engine 

Fail Low events will normally be Nonrecoverable. 

• Some Surge events are also associated with powerloss. 

• A Surge event can be severe enough to cause collateral damage, or conversely, some

source of engine damage may be the cause of a surge. The loss of power in either of

these cases could typically be considered the equivalent of a Engine Fail Low state. 

• Engine damage that makes a Surge PSM similar to a Engine Fail Low assigns it to the 

Nonrecoverable category. Data indicates that if an engine that has sustained a 

Nonrecoverable Surge produces power (thrust), it will be at a minimal level (idle or 

lower). Thus, it may be reasonable to consider including Nonrecoverable Powerloss 

(Nonsurge) and Nonrecoverable Surge events as subcategories of Failed Engine Low 

events. 

The Simulator Issues Group (SIG) that was established in response to AIA PSM+ICR report 

recommendations documented investigations undertaken to make recommendations to improve 

PSM simulations. The SIG report provides definitions of PSM events. Although these 

definitions were developed on the basis of identifying means to improve flight simulators for 

training purposes, they align with the definitions and findings herein. The SIG reported three 

types of compressor surge malfunctions as having major shortfalls in cueing noise and tactile 

(thrust pulse and vibration) response. 

• Compressor surge—self-recoverable (type 1) 

• Compressor surge—multiple, recoverable with pilot action (type 2) 

• Severe engine damage with compressor surge (type 3) 

5.1.1 Propulsion System Malfunction Categories From Existing Data. 

Data from IFSD and 2000-2001 PSM events was grouped into specific categories. One of these 

categories is Surge. If the events from this category and several others, directly attributable to 

the engine, are added together (e.g., Flame-Out, Disintegration), the sum accounts for 53% of the 

total events. Categories excluded are related to failures in ancillary engine systems (e.g., 

hydraulic, pneumatic, and oil systems). Of the events in the Surge, Flame-Out, Disintegration 

subgroup, approximately two-thirds are surge-related. This is the same percentage as seen in the 

PSM+ICR events. 

5.1.1.1 Characterization of PSM Events Resulting in ICR. 

The general PSM categories previously defined are qualified by PSM characteristics. These 

characterizations often describe symptoms and not a root cause of the PSM. Thus, the 

characterizations provided herein can be considered primarily as symptomatic descriptions of

root-cause PSMs. 

5-4
Subsequent analysis and data reviewed support the conclusion that PSM events that most 

frequently result in ICR are Nonrecoverable Engine Failed Low, Nonrecoverable Powerloss, and 

Surge (Recoverable and Nonrecoverable) events. Further, it may be possible to include the 

Nonrecoverable Powerloss and Nonrecoverable Surge events as a subcategory of Engine Failed 

Low events (Note: the use of subcategories implies the existence of a Engine Failed Low

(Nonsurge) subcategory). Because these PSMs are the greatest contributors to ICR, additional 

characterization of these PSMs categories was pursued. 

Determining that a malfunction of the propulsion system has occurred is based on an 

examination of indications or symptoms resulting from the malfunction, e.g., specified pressures 

or temperatures or required control inputs are not matching expectation. There are regions in the 

operating envelope where reliable detection from examining indications is impaired by 

uncertainty (from variations in measurements, configuration, deterioration, etc.). A potential 

means to overcome this uncertainty is the use of some type of procedure that challenges the 

propulsion system for conditions other than the current power setting. However, using such a 

procedure imposes a risk of inducing additional system damage. 

5.1.1.2 Characterization of Indicated and Monitored Parameters. 

This section is provided to further refine the parametric characterizations provided above. These 

refinements are stated for various classes of engine and various parts of the operating envelope. 

Definitions of engine classes are as follows: 

• HBPR, 7 < BPR < 10 

• Medium By-Pass Ratio (MBPR), 3 < BPR < 7 

• LBPR 1 < BPR < 3 

• Hi Fn, High Power (Thrust) Capability, 70,000 < Fn (lbf) < 100,000+ 

• Med Fn, Medium Power (Thrust) Capability, 35,000 < Fn (lbf) < 70,000 

• Low Fn, Low Power (Thrust) Capability, 15,000 < Fn (lbf) < 35,000 

The engine spool-down characteristic is dependent on the moment of inertia of the spool 

(table 5-1) and the speed (Mach number) the engine is traveling through the air. A basic 

equation to define the time to reach wind-milling speed is as follows: 

∆ = (Ι/ ) ∗{( /(− +1)) ( /(− +1))} (− +1) (− +1) t n n n

w

n α ωi ω

Where I = Moment of inertia of the spool 

α = Rotational speed decay coefficient 

ωi = Initial rotational speed

ωw = Wind-milling rotational speed

n = Some integer greater than 1

Values for the rotational speed decay coefficient are derived using the moments of inertia in the 

equation above with empirical data available. Representative coefficients for several engine 

types at different conditions are provided in table 5-2. 

5-5
TABLE 5-1. MOMENTS OF INERTIA FOR ENGINE CLASSES

I - Moments of Inertia (lb ft2) 

Two Spool Three Spool 

Spool L H L I H

HBPR Hi Fn 16950 1455 8400 1400 470 

HBPR Med Fn NA NA NA NA NA 

MBPR Med Fn 5770 595 3100 1100 410 

MBPR Low Fn 950-1123 230-690 

LBPR Med Fn NA NA NA NA NA 

LBPR Low Fn NA NA NA NA NA 

TABLE 5-2. REPRESENTATIVE ENGINE COEFFICIENTS 

Condition α - Decay Coef n 

HBPR Hi Fn 

2 Spool 

35k ft/M~.7 L

H

3319.36 

228558 

5.0 

4.5 

HBPR Med Fn 

2 Spool 

L

H 

HBPR Hi Fn 

3 Spool 

35k ft/M~.8 L

I

H

2116320 

0.4161183 

0.4761628 

7.0 

2.5 

2.0 

LBPR Med Fn 

2 Spool 

9k ft/M~.5 L

H

2.86578 

39201.5 

2.5 

3.5 

The coefficient is variable with flight condition. A means to create a matrix of coefficients for 

various flight conditions would be to obtain data from a flight simulator with an engine 

shutdown induced at the desired conditions. This data would then be correlated to the service 

data provided above. 

Indicated pressures will exhibit a decay characteristic that tracks the spool speed associated with 

that pressure. For example, if an EPR is displayed, the decay will track the low-pressure spool, 

as the pressures in the ratio are associated with that spool. 

For an Engine Fail Low event, there is no engine temperature characteristic that can be used to 

reliably key on. The engine temperature is primarily dependent on whether the combustion 

process continues in the failed state. If combustion ceases, (fuel cutoff, flame-out) the engine 

temperature characteristic will be that of a Powerloss event. 

5.1.1.2.1 Powerloss. 

For a Powerloss event, the engine spool speeds will decay in the same manner as an Engine Fail 

Low event. A means to model this decay was provided in section 5.1.1.2. Again, any pressure 

5-6
indications will track the decay in spool speed. The Temperature, EGT, for a Powerloss event 

will exhibit a given characteristic. The EGT will typically rise by approximately 5% of the 

engine temperature at the time of the event and then begin to decay toward ambient temperature. 

The temperature rise will peak after 5-7 seconds. The temperature decay is dependent on the 

ambient temperature and the speed (Mach number) at which the engine is traveling through the 

air. 

5.1.1.2.2 Surge. 

Again, referring to the SIG report, characteristics of a Surge event include the following: 

• A motion effect, associated with a max power surge, which is simulated by a lateral sine 

wave input of 0.5 g with a time period of 0.75 second or less 

• A vibration effect, similar to an airframe buffet, that fades out linearly over 2 to 4 

seconds 

• An aural effect that is dependent on the engine cycle and power setting. 

The audible indication, for high-power conditions, has been described as a sharp pop for a low 

by-pass ratio fan or turbojet engine, while a large high by-pass engine will be a highly energetic 

boom. The intensity of this aural effect (i.e., volume) is weakly dependent on the power 

setting—the sound is louder at high power than at low power but not necessarily significantly. 

Finally, the report listed engine parameter effects of a compressor surge as a rapid decrease in 

rotor speeds, pressures, and fuel flow, and typically an increase in EGT. Some ranges of 

variation of these engine parameters are as follows: 

• EPR/Burner Pressure 60%-90% drop to coincide with bang sound 

• N1 15%-40% drop to coincide with bang sound 

• N2 or N3 5%-10% drop to coincide with bang sound 

• EGT 10-20 deg/sec rise 

These ranges are developed from data for surges at a high power setting tabulated in Appendix A 

of the SIG report. The variations of pressure and spool speed are percentages of the initial value. 

The parameters will fluctuate in these ranges for 1 to 3 seconds. The pressure and spool speed 

ranges can be considered valid for a surge at any power setting, realizing that the initial values 

will be smaller. The duration of fluctuation will typically be shorter for a lower power setting. 

The characteristics of a surge at low power are typically very subtle. Recent reports, not 

included in the SIG report, indicate that for surges that occur at cruise conditions, the intensity of

the aural indication is low enough to go undetected on the flight deck. The following is an 

excerpt from an airline report on a flight in which low power surges were experienced. 

“The pilots in the cockpit heard nothing. They felt shaking, which they thought at 

first was clear air turbulence. There was absolutely no yaw. Left EGT was 

within limits, slightly higher than the opposite engine, but rpms looked like idle. 

When they listened for it, they were able to hear a faint, periodic rumble.” 

5-7
The EGT fluctuation characteristic for a high power surge may or may not be present in a low 

power surge. This is likely due to the time period of the Surge event itself. For a high power 

surge, the cycle disturbance lasts longer than the sensor lag. 

5.1.1.3 Nonrecoverable Surge. 

This type of PSM is more fully described by combining characterizations provided above. First, 

a surge characteristic is experienced. Then, depending on the nonrecoverable failure mode, 

additional surges are experienced until power setting is reduced or the engine exhibits an Engine 

Fail Low characteristic. Again, the Nonrecoverable identifier says that the engine does not run 

event-free at all possible power settings. 

5.1.2 Propulsion System Malfunction Event Characterization Data. 

Queries of data bases available to Boeing were conducted to determine what data was available 

for PSM event characterization and analysis. Table 5-3 lists the data sets available for various 

PSM categories. 

TABLE 5-3. EVENT DATA FOR ANALYSIS 

Recoverable Surge

Nonrecoverable 

Surge 

Recoverable Engine 

Failed Low

Nonrecoverable 

Engine Failed Low

PSM+ICR 

Events 

94/MWB/4/I 

93/EWB/2/I 

89/MNB/2/HF 

93/MNB/2/I 

91/MNB/2/H 

 

As is reflected in table 5-3, no data is available from the AIA PSM+ICR report to support 

characterizations provided herein for Recoverable and Nonrecoverable Engine Failed Low 

events. 

The applicable events from the AIA PSM+ICR report are analyzed to develop in-service 

experience characterizations. Plots of parametric data available from a subset of the PSM+ICR 

events are provided in appendix D. The principal investigators identified five events for which 

data is plotted (table 5-4). 

TABLE 5-4. THE PSM+ICR EVENTS WITH DATA PLOTS 

PSM ICR Data Set Plot

Recoverable Surge Shutdown Good Engine 94/MWB/4/I 

93/EWB/2/I 

Figure D-1 

Figure D-2, 3 

Nonrecoverable Surge Shutdown Good Engine 89/MNB/2/HF 

93/MNB/2/I 

91/MNB/2/H 

Figure D-4, 5 

Figure D-6 

Figure D-7 

Recoverable Fail Low 

Nonrecoverable Fail Low 

5-8
As shown in table 5-4, items 89/MNB/2/HF, 93/MNB/2/I, and 70/2ND/2/H from the list of 

events provided in appendix D apply to the Nonrecoverable Surge category. Items 95/2ND/2/H 

and 96/MWB/4/I from appendix A are applicable to the Nonrecoverable Engine Fail Low 

(Nonsurge) category. 

5.1.3 Data Sets Used for Analysis of PSM Surge Events. 

Proprietary data was provided to a subcontractor for analysis. The data is available at high 

capture rates for various parameters. Data for various parameters was provided at 1, 2, 4, 16, 

and 50 Hz. The parameters and capture rates are not consistent across the data. 

The results of the subcontractor analysis are provided in appendix E. Key excerpts from the 

summary section are provided as follows. 

5.1.3.1 Required Parameters. 

Figure 5-1 shows practical set of parameters that have been identified for enabling enhanced 

surge awareness and surge recoverability. The first seven categories of parameters should be 

made available at greater than or equal to 2-Hz sampling rates. The essential set of parameters 

are denoted and are those required for the Surge Detection and Recoverability Algorithm

developed under this program and discussed next. It should be noted that this set only applies to 

high-by-pass turbofan engines with FADECs. Different parameters and sampling rates may be 

best for other engine types with or without FADECs. 

FIGURE 5-1. ENGINE ANALYSIS PARAMETER SET 

5.1.3.2 Surge Detection and Recoverability. 

Subcontractor team members developed a Matlab/Simulink program to analyze surge detection 

and recoverability determination. The premise is that key parameters/features such as XNHDOT 

(the derivative of core speed) and P25DOT, P3DOT should normally lag throttle position (TRA) 

5-9
and gas path bleeds. Since in a Surge event a compressor is in an unstable dynamic state, 

changes to the key parameters are expected to lead TRA or bleeds and be uncorrelated to them

within a certain time buffer. Hence, two surge detection modules were created in the generic 

Matlab/Simulink program called SEDRA (Surge Event Detection and Recovery Analysis); the 

results of which are fused together. The first module independently considers limit exceedances 

of XNHDOT and P25DOT, P3DOT, depending on the available data. The second module 

considers a zero lag cross correlation between the aforementioned parameters. 

5.2 FEASIBILITY ASSESSMENT OF DETECTION METHODS. 

The previous discussion defines the constrained categories of PSM for which detection concepts 

are required. Feedback was solicited for these constrained PSM categories from Boeing experts 

and from engine OEMs. This feedback is summarized as feasibility assessments for detection 

herein. 

The question of feasibility of detection for some PSMs is somewhat obsolete. The current 

generation of commercial airplane engines already includes algorithms to detect numerous 

malfunction conditions, including some of the PSM under consideration here. The more 

pertinent question may be how accurate or robust these algorithms are (no missed detects, no 

false detects). 

Some engine controls include a surge bit as part of the monitoring output. A Surge PSM is 

symptomatic in nature. Restated, a surge occurs as a result of some other engine damage, 

deterioration, or a (drastic) change in ambient conditions. This suggests that what really needs to 

be detected is the damage or deterioration. However, when considering the reduction of the risk 

of an undesired outcome to a PSM, some form of indication of a surge may be valid. The 

purpose of this indication is to accommodate the Association Ground Rule, which: 

• puts a positive linkage between a Surge event and its aural characteristic (the bang). 

• identifies which engine the surge came from. 

One airplane model produces an Engine Fail indication. This is, in essence, what is referred to 

herein as a Nonrecoverable PSM. Refining and expanding the capabilities of these algorithms

will be the focus of ongoing development. This development will occur regardless of nonmarket 

impetus. 

5.2.1 Feasibility Assessment Technical Expert Feedback. 

Technical experts from Boeing agree that from a first principles standpoint, the engine burner 

pressure is the primary indicative parameter for surge. The engine exhaust gas temperature is an 

additional indicator for surge. Using these parameters on existing airplanes is problematic in the 

response of the sensors used to measure them. In the case of the burner pressure, the sensors 

need to be able to produce accurate pressure, with a rapid response, in a range from 15 to 450 

psi. The transient nature of a Surge event is damped by the responsiveness of the thermocouples 

or other temperature-measuring devices used to capture engine exhaust temperature. 

5-10
The determination of recoverability is less apparent to Boeing. The current flight operations 

procedure for a surge is to reduce power, check for normal operation at idle, and then reapply 

power to check for normal operation at high power. The technical experts believe that a welltrained crew using this procedure will produce results as reliable as a logic designed to determine 

normal operation. Still, an algorithm that uses burner pressure, engine exhaust temperature, and 

engine rotational speeds is considered possible. Caveats to this perception include 

• the need for better response from parameter sensors. 

• the need to collect empirical data from individual engines, and the ability to create a 

generalized model from that data. 

• changing the engine power setting during algorithm execution would likely be required. 

The lack of confidence in a system because of false alarms (or missed detects) makes the 

implementation somewhat dubious. 

A PSM detection scheme related to the Recoverability subject is the comparison of Actual 

Thrust to Commanded Thrust. This scheme suggests the engine is back in control, which 

follows the logic of the subcontractor work described below. This scheme is suggested as a 

means to identify Engine Fail (Low, High, Fixed) and Powerloss. As stated above, the Engine 

Fail Low state is closely related to the Recoverability issue. 

This method is used in some production airplanes to identify the existence of Thrust Asymmetry 

and is constrained to a PSM resulting in a thrust shortfall. A thrust shortfall is identified by 

comparison of both commanded and actual thrust from an engine model. Commanded thrust is 

determined from the power-setting input, whereas actual thrust is calculated using the powersetting and engine parametric data. Identification of an actual thrust, some prescribed amount 

lower than the commanded thrust, would be identified as a thrust shortfall. For example, 

existing applications use a prescribed difference in commanded to actual thrust of approximately 

10% to activate Engine Failure and Thrust Loss logic. 

The risk of false or missed detects using this method lies in the current method to measure thrust. 

In reality, thrust is not measured on-wing. What is measured is a parameter that is used to 

indicate that an assumed thrust has been obtained. This method has been certified through the 

development of a model of the test stand and/or instrumented airplane’s measured thrust and the 

indication parameter. This model is developed to ensure that a minimum thrust is attained. The 

thrust may be higher due to, in varying degrees, engine configuration, engine-to-engine 

variation, engine age, etc. Additionally, the model is not developed to provide a thrust indication 

during a transient. Most importantly, the model does not include an indication/thrust 

relationship for a damaged engine (i.e., if the engine is damaged, the thrust to indication 

parameter relationship is unknown). The risks in using this method increase as the commanded 

thrust decreases (i.e., the determination of actual thrust, from parametric data, to compare to a 

commanded thrust is more difficult at low power settings). This is because the inaccuracies of 

the thrust to indication parameter model becomes more pronounced at low power. The increased 

risk of missed detection during a transient or low power settings may lead to inhibiting the 

5-11
detection algorithm in these operational states. This inhibit leaves open the operational risk of 

missed detection at low power, leading to the crew being unaware that higher power will not be 

obtained from the failed engine if commanded. The detection method would provide a valid 

result only when the higher power is commanded, at which time the crew would be alerted. 

As stated, the current thrust models were developed to certify the thrust to indicating parameter 

relationship for minimum thrust of a nonmalfunctioning engine. Significant development is 

required to produce models of thrust deviation for all possible PSM modes. The reliability of

current models is not compatible with the ability to certify a system for determination of thrust in 

malfunctioning engines. 

5.2.2 Feasibility Assessment From Engine OEM Technical Expert Feedback. 

Coordination memos were sent to two engine OEMs. A formal response from one engine OEM 

has been received. Lacking time to fully interpret this response and a complimentary response 

from the other OEM, it is inappropriate to report on informal responses received. 

5.2.3 Feasibility Assessment From Task 5.2 Analysis. 

Task 5.2 shown in appendix E is entitled “Data Acquisition and Detection Methods.” The 

purpose of this task was to assess the data available for potential methods of detecting a given 

PSM. The focus of the study was surge PSM because the analysis thus far identifies surge as a 

contributor to a significant number (<70%) of undesired outcomes. The objective of the task 

was to analyze high-fidelity data collected when a surge occurred to: 

• identify any precursors. 

• investigate means of determining recoverability. 

• assess the adequacy of available data or need for additional parameters. 

The subcontractors for this task, Impact Technologies LLC, produced an algorithm that identifies 

a Surge event and provides an indication of recoverability. Appendix E provides a detailed 

description of the task results. Some important conclusions are provided herein to meet the 

objectives of this report. 

Appendix E concluded that a means to more reliably detect a surge is possible with data 

available from a FADEC-controlled engine with at least one qualifier. Most health management 

data capture is performed at 1 Hz. This data capture rate leaves detection methods vulnerable to 

the engine control logic attempting to adapt to the PSM. Impact Technologies recommends a 

capture rate of 50 ms or less. 

The detection scheme developed employs a derivative limit for various parameters combined 

with a cross correlation of those parameters. The derivative functions are based on engine 

component performance maps derived empirically from the data. This algorithm successfully 

detected the surges identified in the data provided. In addition, the data contains what are agreed 

to be false detects of a Surge event. The subcontractor’s algorithm was successful in avoiding 

false detects on this data. 

5-12
Impact Technology fused the results of the surge detection algorithm with a tool to determine 

whether the engine would recover from the surge or not. It is important to provide a definition 

of recoverability in context of this contract work. A surge that will recover (Recoverable Surge) 

is a PSM after which the engine will respond to engine control (automatic or crew intervention) 

to provide any requested power setting/thrust. Conversely, a Nonrecoverable Surge is a PSM 

after which the engine, although it may run surge-free at some power settings, is not able to 

produce the requested thrust at all possible power settings. Again, the Time Lag Ground Rule, 

detection is not to be a time-critical function (e.g., RTO>V1), applies to concepts for 

determining recoverability. 

The task 5.2 report states that the recoverability detection scheme “... operates in much the same

fashion as the surge detection except that it waits for ... [engine parameters] ... to respond 

normally to TRA and Bleed, meaning that the engine is back in control.” This scheme was 

successful in determining whether an engine would recover from a Surge event or not. The time 

required was on the order of 3 to 5 seconds. Impact Technology states that the addition of a 

vibration monitor to the aforementioned could improve the robustness (no missed detects, no 

false positives) of the surge detection/recoverability scheme. 

The subcontractor stresses the fact that claims of success are based on a single data point in the 

case of Nonrecoverable Surge. With this qualifier, the research performed by Impact 

Technologies is promising. 

5.3 SIMULATOR EVALUATION AND REQUIREMENTS. 

The principal objective of the overall research effort was to evaluate PSM+ICR events, identify 

contributing factors, assess the detection and prevention potential of PSM annunciations, and 

establish a framework for understanding UCR to PSMs. The principal goal was to promote 

understanding of these events and develop recommendations pertaining to Propulsion System

sensing and Flight Deck indication in general, and PSM detection and Flight Deck annunciation 

in particular. 

5.3.1 Overview. 

As part of this overall research effort, Task 6.3, Development of Simulator Research Evaluation 

Requirements, was accomplished. The objective of the task was to document a plan for 

development and refinement and test and validation of the report PSM annunciations 

recommended in the tasks 1.2 and 1.3 reports. This plan is provided as proposed future effort. 

5.3.2 Task 6.3 Background and Methodology. 

Task 6.3 consisted of the development of simulator research/evaluation requirements and a 

preliminary plan for simulator demonstration and evaluation of engine failure, surge, and thrust 

asymmetry for their effectiveness in preventing or reducing ICR to these PSMs. The 

development of these requirements was based on research, analysis, and recommendations from

other task reports and on past practical simulator study/evaluation experience. 

5-13
5.3.3 The PSM Annunciation Simulator Research Evaluation Requirements. 

The following sections document a preliminary top-level simulator research PSM annunciation 

evaluation plan. 

5.3.4 Research Issues/Questions. 

• What is the appropriate means of Flight Deck PSM annunciation of Powerloss (Engine 

Subidle and Thrust Shortfall), Surge, and Stuck Thrust (Thrust Shortfall and Overthrust)?

• What is the effectiveness and the operational performance effects of Flight Deck PSM 

annunciation of Powerloss (Engine Subidle and Thrust Shortfall), Surge, and Stuck 

Thrust (Thrust Shortfall and Overthrust)?

• What is the operational acceptability of Flight Deck PSM annunciation of Powerloss 

(Engine Subidle and Thrust Shortfall), Surge, and Stuck Thrust (Thrust Shortfall and 

Overthrust)? 

• Should Thrust Asymmetry, Stuck Throttle, and High Vibration annunciations be 

provided, and if so, how?

5.3.5 Test Objectives. 

• Develop and refine PSM annunciation implementations for Powerloss (Engine Subidle 

and Thrust Shortfall), Surge, and Stuck Thrust (Thrust Shortfall and Overthrust).

• Objectively and subjectively test and validate PSM annunciation implementation 

concepts for Powerloss (Engine Subidle and Thrust Shortfall), Surge, and Stuck Thrust 

(Thrust Shortfall and Overthrust). 

• Define and document Powerloss (Engine Subidle and Thrust Shortfall), Surge, and Stuck 

Thrust (Thrust Shortfall and Overthrust) implementation requirements. 

5.3.6 Test Experimenter(s) and Facility. 

• Multidisciplinary Boeing Company Experimenter Engineering Team: Flight Deck Crew

Operations, Propulsion Systems, Human Factors, and other group review support. 

• Boeing Company Integrated Airplane Systems Laboratory (IASL) engineering 

simulator(s). Engineering Cab TBD: B777 (figure 5-2), Motion-Cab, and/or Other 

(B737, B757, B767, or B747-400) 

5-14
FIGURE 5-2. B777 ENGINEERING CAB 

5.3.7 Malfunctions. 

• Powerloss—Engine Subidle and Thrust Shortfall. 

• Surge—Self Recoverable, Recoverable only with Crew Action, and Nonrecoverable. 

• Stuck Thrust—Thrust Shortfall and Overthrust. Stuck Throttle, High Vibration and 

Thrust Asymmetry testing and evaluation TBD. 

5.3.8 Propulsion System Malfunction Annunciation Test Concepts. 

Engine indication annunciation and EICAS alert annunciation concepts are in development and 

will be reported as part of Task 6.4, Engine Malfunction Annunciations Demo. Concepts in 

development for Engine Indication annunciation and EICAS Alert annunciation for: 

• Powerloss (Engine Subidle and Thrust Shortfall) 

• Surge 

• Stuck Thrust (Thrust Shortfall and Overthrust) 

• Engine Status—Including Normal/Good Engine Concepts

5.3.9 Pilot Test Subjects/Evaluators. 

• Initial Testing: Minimum 12 Boeing pilot test subjects/evaluators—typically half Flight 

Test Engineering and half Flight Training. 

• Follow-on Testing: Customer line, training, and engineering/management pilots. FAA 

FAR Part 25 Certification and FAR Part 121 Operations pilots. 

5-15
5.3.10 Preliminary Experimental Design. 

• Objective between subject blind test design—different pilots tested for nonannunciation 

and annunciation concept performance. 

• Subjective between blind and follow-up within nonblind subject test design—different 

pilot subjects were tested for annunciation and nonannunciation performance and, 

subsequently, provided subjective assessments. After the initial testing and debrief,

subjects are briefed on the true nature of the test evaluation. The nonannunciation 

subjects then flew annunciation concepts and provided subjective comments and 

assessments; annunciation pilots flew nonannunciation scenarios and provided subjective 

comments and assessments. 

• The presentation of scenarios and concepts was typically mixed/balanced to minimize the 

potential for learning transfer and/or practice effects. Table 5-5 shows a PSM 

annunciation test concept versus a malfunction matrix, which will be used to develop 

detail test plans. 

TABLE 5-5. THE PSM ANNUNCIATION TEST CONCEPT VERSUS 

MALFUNCTION MATRIX 

No Annunciation1

Engine 

Indication 

Annunciation 

Only

2

EICAS Alert 

Annunciation 

Only

3

Engine Indication and 

EICAS Alert 

Annunciations Combined3

Normal—No Malfunction N/A N/A N/A 

Engine Failure (subidle) X X X 

Engine Surge X X X 

Thrust Shortfall X X X 

Overthrust X X X

1. Pilot Engine Indication Monitoring and PSM Detection and Interpretation. Unannunciated/Unlinked 

Nonnormal Procedure. 

2. Automated Monitoring and Detection, Explicit PSM Engine Indication Annunciation Unannunciated/

Unlinked Nonnormal Procedure. 

3. Automated Monitoring and Detection, Explicit PSM Alert Annunciation. Linked Nonnormal Procedure.

5.3.11 Malfunction Test Scenario Matrix. 

Table 5-6 shows a phase of flight versus propulsion system malfunction matrix, which will be 

used to develop detail test plans. 

5-16
TABLE 5-6. FLIGHT PHASE VERSUS PROPULSION SYSTEM MALFUNCTION MATRIX 

Propulsion System Malfunction 

Flight Phase* None Engine Failure Surge Thrust Shortfall Overthrust 

Takeoff Ground Roll 

Takeoff Climb 

Cruise to Descent 

Descent Level Off

Approach and Landing/Go 

Around 

To ensure an adequate workload level and to assess the level of system awareness provided by 

each concept, various operational tasks and additional system misconfigurations and failures are 

typically used. A balanced presentation of concepts will minimize the opportunity for transfer 

and/or practice effects. 

5.3.12 Data Collection, Analysis, and Reporting. 

5.3.12.1 Objective Data Collection, Analysis, and Reporting. 

• Time Stamped 250 millisecond frame rate Simulation Data: Multiaxis Accelerations, 

Airspeed, Altitude, Attitude (Pitch and Bank), Heading, Vertical Speed, Flight Mode 

Annunciations, Throttle Lever Angle, Flight Control Inputs, Primary and Secondary 

Flight Control Surface and Gear Positions, Fuel Control Switch state, Fire Handle state, 

Engine Parameter Indications (EPR, N1, EGT, N2, Vibration, Fuel Flow, Oil Pressure (P) 

and Temperature, Autothrottle and Autopilot engagement, Engine Indication 

Annunciations, Alert Annunciations, Electronic Checklist Selections, etc. 

• Flight/Operational Performance, Response Time, Error Recording, etc. 

• Objective Data Reporting—Reduction (e.g., Analysis of Variance (ANOVA) and other 

data analyses for statistical significance), Data and Results Discussion 

5.3.12.2 Subjective Data Collection, Analyses, and Reporting. 

• PSM Awareness Level 

• PSM Understanding Level 

• Overall PSM Awareness and Interpretation Effort 

• PSM Annunciation Concept Assessment 

* Instrument Meteorological Conditions and Night Visual Meteorological Conditions.

• Video and Audio Recording 

• Workload

• PSM Annunciation Concept Usability 

5-17
• PSM Annunciation Concept Rankings 

• Subjective Data Discussion and Reporting 

5.3.12.3 Test Data Analysis. 

Typically, a normal baseline performance for each phase of flight to be tested was established for 

each pilot test subject as part of warmup and familiarization. This baseline allowed a relative 

within subject assessment of normal versus nonnormal pilot operational performance, response 

times, and errors. 

The pilot test subjects who flew the nonannunciation concept scenarios collectively establish a 

baseline objective performance average against which objective performance with annunciation 

concepts were analyzed for statistically significant differences. Similar analysis was 

accomplished using the subjective data collected. Objective and subjective data were correlated 

for trends and significance. 

The following are examples of typical performance measures: 

• Time-to-initiate action—typically measured from some initial condition 

(e.g., malfunction insertion) and from the appearance of an annunciation to the first clear 

compensatory control or corrective action taken. This is predominately objective data. 

• Time-to-complete actions—typically measured from the first compensatory control or 

corrective action taken to the last switch activation or cursor click for each task. This is 

predominately objective data. 

Errors were typically identified by recording deviations from the expected/accepted levels of 

flight performance, appropriate selection of nonnormal procedure, and appropriate sequence of 

related compensatory control or corrective actions. This is predominately objective data. 

Workload, both mental (subjective) and physical (objective), was typically evaluated as reported, 

observed, or recorded. This is typically a mix of objective and subjective data. 

Malfunction detection/awareness of system state/configuration and of confederate pilot errors 

was typically evaluated. This is typically a mix of objective and subjective data. 

Malfunction interpretation/understanding of system state/configuration and of confederate pilot 

errors was evaluated. This is typically a mix of objective (response) and subjective (reported) 

data. 

When collected, video, audio, and simulator data were typically collected continuously. For 

each scenario, simulation variables were automatically recorded and time stamped by computer 

simulation monitoring. Subjective data were typically collected immediately after each 

concept/scenario, and at the end of each significant debrief. A questionnaire collected additional 

overall opinions and comments after the final session debrief. 

5-18
6. BIBLIOGRAPHY. 

Abbott, T.S., 1990, A Simulation Evaluation of the Engine Monitoring and Control System

Display, NASA Tech Rep No 2960, Hampton, VA, NASA Langley Research Center. 

Abbott, T.S., 2000, Task-Oriented Display Design: The Case of an Engine-Monitoring Display, 

N.B. Sarter and R. Amalberti (eds.), in Cognitive Engineering in the Aviation Domain, Erlbaum. 

Broadbent, D.E., 1971, Decision and Stress, New York, Academic Press. 

Clark, S., and Winters, V., 2002, Task 2.1 report. 

Dinadis, N. and Vicente, K.J., 1999, “Designing Functional Visualizations for Aircraft Systems 

Status Displays,” International Journal of Aviation Psychology, 9(3), pp. 241-269. 

Dismukes, K., Young, G., and Sumwalt, R., 1998, “Cockpit Interruptions and Distractions: 

Effective Managing Requires a Balancing Act,” ASRS Directline, 10, pp. 4-9. 

Evans, J. St. B.T. 1989, Bias in Human Reasoning: Causes and Consequences, London, 

Erlbaum.

Fitts, P.M. 1951, Human Engineering for an Effective Air Navigation and Traffic Control 

System, Washington, DC, National Research Council. 

Gentner, D., and Stevens, D.R., 1983, Mental Models, Hilldale, NJ, Erlbaum.

Helmreich, R.L., Klinect, J.R., and Wilhelm, J.A., 1999, “Models of Threat, Error, and CRM in 

Flight Operations,” In Proceedings of the Tenth International Symposium on Aviation 

Psychology, The Ohio State University, Columbus, OH, pp. 677-682. 

Hornsby, M., 1992, “Engine Monitoring Display Study,” NASA Contractor Report 4463. 

Hutchins, E., 1993, “An Integrated Mode Management Display,” Paper presented at the NASAAmes Mode meeting, Moffett Field, CA, NASA-Ames Research Center. 

Mumaw, R.J., Sarter, N., Wickens, C., Kimball, S., Nikolic, M., Marsh, R., Xu, W., and Xu, X., 

2000, “Analysis of Pilots’ Monitoring and Performance on Highly Automated Flight Decks,” 

Final Project Report, NASA Ames Contract NAS2-99074, Seattle, WA, Boeing Commercial 

Aviation. 

Oakhill, J.V. and Garnham, A. Eds. (1996). Mental Models in Cognitive Science: Essays in 

Honour of Phil Johnson-Laird, Hove, East Sussex: Psychology Press. 

Rasmussen, J., 1985, “The Role of Hierarchical Knowledge Representation in Decision Making 

and System Management,” IEEE Transactions on Systems, Man, and Cybernetics, SMC-15,

pp. 234-243. 

6-1
Rasmussen, J., 1986, Information Processing and Human-Machine Interaction: An Approach to 

Cognitive Engineering,” New York: North-Holland. 

Roth, E.M., Bennett, K.B., and Woods, D.D., Human Interaction With an “Intelligent” 

Machine,” International Journal of Man-Machine Studies, 27, 1987, pp. 479-525. 

Sarter, N.B. and Woods, D.D., 1997, Team Play With a Powerful and Independent Agent: 

Operational Experiences and Automation Surprises on the Airbus A-320,” Human Factors, 39,

pp. 553-369. 

Shontz, W., 1996, Surge Study, Boeing manuscript, Seattle, WA, Boeing. 

Simon, H.A., 1957, Models of Man, New York, Wiley. 

Summers, L.G., 1993, “Evaluation of Advanced Displays for Engine Monitoring and Control,” 

NASA Contractor Report 191418. 

Vicente, K.J., 1999, Cognitive Work Analysis, Mahwah, NJ, Erlbaum.

Vicente, K.J., Moray, N., Lee, J.D., Rasmussen, J., Jones, B.G., Brock, R., and Djemil, T., 1996, 

Evaluation of a Rankine Cycle Display for Nuclear Power Plant Monitoring and Diagnosis, 

Human Factors, 38, pp. 506-521. 

Wickens, C.D., 2000, “Pilot Expectancy and Attentional Effects for Hazard Awareness: 

Implications for Free Flight and Datalink,” Final Technical Report ARL-00-6/FAA-00-3, Savoy, 

IL, and University of Illinois, Aviation Res. Lab. 

Woods, D.D., Wise, J.A., and Hanes, L.F., 1982, “Evaluation of Safety Parameter Display 

Concepts,” NP-2239, Palo Alto, CA, Electric Power Research Institute. 

6-2
7. RELATED DOCUMENTS. 

“Airplane Turbofan Engine Operation and Malfunctions: Basic Familiarization for Flight 

Crews,” Air Transport Association and Flight Standards Division of Federal Aviation 

Administration, November 2000. 

“Propulsion System Malfunction Plus Inappropriate Crew Response (PSM+ICR),” Aerospace 

Industries Association and The European Association of Aerospace Industries, November 1, 

1998. 

“Turbofan Engine Malfunction Recognition and Response,” Air Transport Association and 

Flight Standards Division of the Federal Aviation Administration, November 2000. 

AIA/AECMA Project Report on Propulsion System Malfunction Plus Inappropriate Crew 

Response (PSM+ICR), Volume 2, 1 November 1998. 

Christoferson, K., Hunter, C.N., and Vicente, K.J., 1996. A Longitudinal Study of the Effects of 

Ecological Interface Design on Skill Acquisition, Human Factors, 38, 523-541. 

Huettig, G., Anders, G., and Tautz, A., 1999, “Mode Awareness in a Modern Glass Cockpit 

Attention Allocation to Mode Information,” In R. Jensen (Ed.), Proceedings of the 1999 Ohio 

State University Aviation Psychology Conference, Ohio State University, Dayton, OH. 

Krichene, Prasad, et. al. “Stall and Surge Control of Compressors Using Real Time Precursor 

Identification,” American Institute of Aeronautics and Astronautics, 2000. 

McKenzie, Axial Flow Fans and Compressors, 1997, Ipswitch Publishing Co. 

Norman, D.A., 1986, Cognitive engineering. In D.A. Norman and S.W. Draper (eds.), UserCentered System Design: New Perspectives on Human-Computer Interaction, Hillsdale, NJ, 

Erlbaum.

Parasuraman, R., Sheridan, T., and Wickens, C.D., 2000, “A Model for Types and Levels of 

Human Interaction With Automation,” IEEE Transactions on Systems, Man, and Cybernetics, 

SMC-30(3), 286-297. 

Proakis, J., Digital Signal Processing, Principles, Algorithms and Applications, Prentice Hall 3rd 

edition. 

Walsh, Gas Turbine Performance, 1998, ASME Press. 

Willems, F., “Modeling and Bounded Feedback Stabilization of Centrifugal Compressors,” 

Technische Universiteit Eindhoven, ISBN 90-386-2931-1. 

Yeung, “Non-linear control of Rotating Stall and Surge With Axisymmetric Bleed and Air 

Injection on Axial Flow Compressors,” California Institute of Tech. 1999. 

7-1/7-2
APPENDIX A—PROPULSION SYSTEM MALFUNCTION AND INAPPROPRIATE CREW

RESPONSE DATA ANALYSIS SUMMARY

A-1
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

ID Number Event 

Class

PSM+ICR Category ICR Appears 

Intentional 

(Y/N/U)

PSM Symptom ICR Cause Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Contributin

Factor 

(Y/N/U)

85 44 85/EWB/4/H H LOSS OF CONTROL N/A THRUST REVERSER FAIL TO DEPLOY 

& Full Fwd Thrust on Eng

No Awareness/Annunciation of T/R Fail. 

Directional Control. Thrust Asymmetry.

U Y N N 

73 10 73/1ST/2/HF HF LOSS OF CONTROL N/A POWERLOSS Attitude/Airspeed Control U Y U U 

83 34 83/1ST/2/HF HF LOSS OF CONTROL N/A POWERLOSS Airspeed Control. Rushed downwind 

approach. CFIT.

U U U U 

85 43 *85/2ND/2/H

F

HF LOSS OF CONTROL N/A POWERLOSS/Surge Attitude/Airspeed Control U Y U U 

92 61 *92/MNB/2/H

F

HF LOSS OF CONTROL N/A STUCK THROTTLE - @ Idle Power Attitude Control. No Awareness/Annunciation 

of Stuck Throttle and Thrust Asymmetry. 

U Y Y Y 

95 74 *95/EWB/2/H

F

HF LOSS OF CONTROL N/A STUCK THROTTLE - @ Climb Power Attitude Control. No Awareness of Stuck 

Throttle and Thrust Asymmetry.

U Y N Y 

95 77 95/2ND/2/HF HF LOSS OF CONTROL N/A POWERLOSS Attitude/Airspeed Control U Y U U 

85 39 *85/EWB/4/S S LOSS OF CONTROL N/A POWERLOSS No Awareness/Annunciation of Subidle and 

Thrust Asymmetry. Attitude/Directional 

Control

U Y Y Y 

83 37 83/1ST/4/HF HF LOSS OF CONTROL N/A POWERLOSS SUSPECTED Attitude/Directional Control U U U U 

88 50 88/EWB/3/I I LOSS OF CONTROL N/A THRUST REVERSER FAIL TO DEPLOY No T/R Fail Awareness. Directional Control. 

Thrust Asymmetry.

U Y N N 

71 6 71/1ST/4/H H LOSS OF CONTROL-TRAINING N/A POWERLOSS + V1 Throttle Cut Attitude/Directional Control N Y U U 

81 27 81/1ST/4/I I OTHER - ATB and R/W Excursion; 

UNCORD APPR & 

LANDING/OFFSIDE - PILOTING 

SKILL

Y Powerloss/Surge. Eng Fire. Rushed downwind approach. Landed 25 kts 

fast.

U N N N

82 32 82/EWB/4/I I OTHER - CREW FAILED TO 

SECURE/Shudown Eng Per 

Emergency Procedure

U Surge Vibration Unknown why crew did not follow emergency 

procedure. Lack of compelling non-normal 

annunciation? Crew choice?

U N N N 

96 81 96/1ST/4/HF HF OTHER - Failed to RTO for 

Powerloss < V1.

Y Powerloss/Surge. No Awareness/Annunciation of PSM? U U U U 

83 35 83/1ST/2/H H OTHER - FAILURE TO COMPLETE 

Eng SHUTDOWN PROCEDURES 

Following RTO

U Powerloss/Surge. Unknown why crew did not follow emergency 

procedure. Lack of adequate/compelling nonnormal annunciation? Crew choice?

U N N N 

91 57 91/2ND/3/I I OTHER - MIS-IDENTIFIED 

MALFUNCTION

N Surge Vibration (Airframe) ICR? No Awareness/Annunciation of PSM. N N N N 

94 68 94/2ND/3/I I OTHER - SHUTDOWN GOOD 

ENGINE

Y Surge Vibration (Airframe) No Awareness/Annunciation of PSM 

location.

N N N N 

93 62 *93/MNB/2/I I OTHER - UNABLE TO 

ISOLATEIDENTIFY WHICH 

ENGINE WAS SURGING

N Surge Vibration/Shudder (Airframe ) N/A N N N N 

A-2
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

85 44

73 10

83 34

85 43

92 61

95 74

95 77

85 39

83 37

88 50

71 6

81 27

82 32

96 81

83 35

91 57

94 68

93 62

Recommended Propulsion 

Detection/Investigation/Study 

PSMs

Propulsion System 

Malfunction/Failure

PSM 

Recoverabl

e (Y/N/U)

Eng 

Ind 

Avail 

(Y/N/U)

Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

PSM 

Thrust 

Asym 

Awareness 

(Y/N/U)

A/P 

Engaged 

(Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Engage

d 

(Y/N/U)

A/T 

Contributing 

Factor 

(Y/N/U)

Engine Symptom 

THRTL CABLE 

SEPARATED-RESULTING 

IN FULL FWD THRUST

N Y U Y Y U N N N THRUST REVERSER (NO.1) DID NOT 

TRANSITION TO "REV THRUST", YAW RIGHT

THRUST INCREASE TO FULL FWD THRUST, 

RIGHT YAW CONTINUED

POWERLOSS - Thrust 

Shortfall/Subidle. Low to High 

Power event.

POWERLOSS U - Did Not 

Recover

Y U Y U U U U U POWERLOSS 

POWERLOSS/TURBINE 

BLADE FAILURE - Thrust 

Shortfall. High Power event.

TURBINE BLADE FAILURE N Y U U Y U U U U POWERLOSS (UNRECOVERABLE) 

POWERLOSS/Surge/ - Thrust 

Shortfall/DISINTEGRATION. 

High Power event.

DISINTEGRATION - 

COMPRESSOR SPACER 

FAILURE

N Y U Y U U U U U COMPRESSOR SURGE, AND POWERLOSS 

THROTTLE STUCK Y Y U Y N Y Y Y Y STUCK THROTTLE 

THROTTLE STUCK Y Y U Y N N N Y Y NO RESPONSE TO COMMANDED POWER 

POWERLOSS/Surge - Thrust 

Shortfall/Subidle/FAN BLADE 

FRACTURE. Low to High 

Power event.

FAN BLADE FRACTURE N Y U Y U U U U U SURGE-LOW POWER, VIBRATION & BANG, 

THRUST LOSS

POWERLOSS - Thrust 

Shortfall/Subidle. Low to High 

Power event.

RUNDOWN BELOW SUBIDLEY Y U Y N Y Y Y Y POWERLOSS (NO.4) 

POWERLOSS/Surge - Thrust 

Shortfall. High Power event.

POWERLOSS SUSPECTED U U U U U U U U POWERLOSS SUSPECTED 

THRUST REVERSER 

SYSTEM BINDING

N U U Y Y U N N N THRUST REVERSER TO UNLOCK POSITION 

POWERLOSS - Thrust 

Shortfall. High Power event.

TRAINING - V1 THROTTLE 

CUT & POWERLOSS NO.3

U Y N Y Y U U U U POWERLOSS 

POWERLOSS N U U N Y N N N N COMPRESSOR SURGE 

Eng Fail/Vibration/LP 

LOCATION BEARING 

FAILURE. Surge? High 

Power. 

LP LOCATION BEARING 

FAILURE

N Y U N Y U N U N EXCESSIVE AVM WARNING LIGHT, 

VIBRATION, COMPRESSOR SURGE

Powerloss - Thrust 

Shortfall/Subidle. High Power.

POWERLOSS U U U U U U U U COMPRESSOR SURGE - POWERLOSS 

Eng Fail - Thrust 

Shortfall/Subidle/Fell Off. 

Surge? DISINTEGRATION. . 

High Power.

DISINTEGRATION N Y U N U N N U N COMPRESSOR SURGE 

Eng Fail/Surge - Vibration, 

Fan Blade Damage. High 

Power.

NOSE SPINNER 

SEPARATION

N Y N N N N N U N HEAVY NOISE AND VIBRATION, 

COMPRESSOR SURGE

Surge - Fan Blade Fracture 

and Turbine Blade Melt. 

Powerloss - Thrust Shortfall? 

High Power.

FAN BLADE FRACTURE N Y N N N N U N COMPRESSOR SURGE 

Surge - Damaged/Missing 

Compressor Blades. High 

Power.

BMOD N Y N N Y N Y N COMPRESSOR SURGE 

A-3
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

ID Number Event 

Class

PSM+ICR Category ICR Appears 

Intentional 

(Y/N/U)

PSM Symptom ICR Cause Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Contributin

Factor 

(Y/N/U)

88 51 88/2ND/2/HF HF OTHER (ICR?) OTHER-DUAL ENG 

POWERLOSS;CONTINUOUS 

SURGING ENGs on two eng 

aircraft. Increased power on 

engines.

Y Surge Power Loss/Eng Fail - Dual Eng. ICR? Low Altitude Takeoff Power Loss - 

EPR Reduction. 

Y N N N 

92 59 92/MWB/2/I I OTHER- Fail to detect Eng Fail and 

ASYMMETRIC THRUST

N Eng Fail Fixed Low - Fail To Respond. ICR? No awareness of Eng Fail to Respond 

and Thrust Asymmetry.

N Y Y Y 

81 30 81/1ST/4/H H OTHER-ATB & R/W Excursion; 

UNCOORD APPR&LNDG-LOCASYM REV THRUST- BELOW 

Vmcg

Y Eng Oil Qty Loss Airmanship/Pilot Judgement. N Y N N 

91 58 91/MNB/2/H H OTHER-DUAL ENG 

POWERLOSS;CONTINUOUS 

SURGING ENGs on two eng 

aircraft. Did not reduce power on 

surging engine #2.

Y Surge Powerloss/Fail (BOTH ENGINES 

SEQUENTIAL)

ICR? Low Altitude Takeoff Power Loss. U N N N 

88 47 88/EWB/4/I I OTHER-EXCESSIVE PITCH 

ATTITUDE (22 deg) and 

Stickshaker @ Liftoff

N Powerloss/Surge. Attitude Control. Power Loss. Thrust 

Asymmetry. Adverse Wind.

U U N N 

68 1 68/1ST/4/HF HF OTHER-PYLON S/O VALVE NOT 

SECURED,UNCONTROLED FIRE

U Engine Fail/Fire Unknown why crew did not follow emergency 

procedure. Lack of non-normal 

annunciation? Crew choice?

U N N N 

96 78 *96/EWB/3/H

F

HF RTO > V1 (After Liftoff) Y Surge/Powerloss. Powerloss. No positive rate of climb. 

Airspeed loss. Captain did not believe 

aircraft had lifted off. No 

Awareness/Annunciation of PSM (Engine 

Surge) or affected Engine(s).

N N N N 

69 3 69/1ST/4/S S RTO@V1. ICR = Braking Delay 

and Technique. A/C Fuel Overload.

RTO - Y. 

Braking - U.

Surge/powerloss eng #2. Bird ingestion 

on engines 1, 2, and 3.

Unknown for Braking. Surge related noise 

and powerloss for RTO. 

Y - RTO. 

U - Braking.

N N N 

81 29 *81/EWB/4/S S RTO<V1. ICR = Braking 

Technique/STOP PROCEDURE.

RTO - Y. 

Braking - U.

Surge. Aircraft Shudder. EGT 

Exceedance.

Unknown for Braking. EGT Warning light 

and FE Eng Fire callout for RTO. 

Y - RTO. 

U - Braking.

N N N 

90 54 90/1ST/4/H H RTO<V1. ICR = Braking Technique RTO - Y. 

Braking - U.

Surge. Unknown for Braking. Surge effects for RTO. U N N N 

78 19 78/2ND/2/H H RTO>V1 Y-PF. N-PIC Powerloss Crew coordination - PF braking with PIC 

attempting takeoff. Training related event.

U N N N 

85 40 85/1ST/4/H H RTO>V1 Y Fire Warning Fire Warning Y N N N 

77 16 *77/EWB/3/I I RTO>V1 Y Surge Engine Failure annunciation. Y N N N 

78 22 78/EWB/3/I-2 I RTO>V1 Y Powerloss Engine Failure annunciation. Y N N N 

85 38 85/EWB/4/I-1 I RTO>V1 Y Surge Surge Effects. U N N N 

86 45 86/2ND/2/I I RTO>V1 Y Surge/Powerloss/Flameout Surge/Powerloss U N N N 

88 48 88/2ND/2/I I RTO>V1 Y Powerloss/Surge Engine Power Loss Indication Y N N N 

A-4
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

88 51

92 59

81 30

91 58

88 47

68 1

96 78

69 3

81 29

90 54

78 19

85 40

77 16

78 22

85 38

86 45

88 48

Recommended Propulsion 

Detection/Investigation/Study 

PSMs

Propulsion System 

Malfunction/Failure

PSM 

Recoverabl

e (Y/N/U)

Eng 

Ind 

Avail 

(Y/N/U)

Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

PSM 

Thrust 

Asym 

Awareness 

(Y/N/U)

A/P 

Engaged 

(Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Engage

d 

(Y/N/U)

A/T 

Contributing 

Factor 

(Y/N/U)

Engine Symptom 

Surge - Compressor Blade 

Separation and Turbine Blade 

Melt. Powerloss - Thrust 

Shortfall/Subidle. High Power.

MULTIPLE BIRD 

INGESTION

N Y Y N U N N N COMPRESSOR SURGES 

Eng Fail - Thrust 

Shortfall/Subidle. Low Power.

THROTTLE STUCK N Y N Y N Y Y Y Y NO REPSONE TO COMMANDED POWER 

OIL LOSS N Y N Y Y N N N N LOW OIL QUANTITY 

Surge - Compressor Blade 

Separation and Turbine Blade 

Melt. Powerloss - Thrust 

Shortfall/Subidle. High Power.

FOD INGESTION (WING 

ICE)

N Y U N U N U N CONTINUOUS COMPRESSOR SURGES 

(BOTH ENGINES SEQUENTIAL)

Powerloss - Thrust Shortfall. 

Surge. High Power.

POWERLOSS U Y U U U N N U N COMPRESSOR SURGE 

Eng Fail - Thrust 

Shortfall/Subidle/Fell Off. 

DISINTEGRATION - 

COMPRESSOR DISK 

FAILURE. High Power.

DISINTEGRATION - 

COMPRESSOR DISK 

FAILURE

N Y U N U U N U N COMPRESSOR SURGE 

Surge. Powerloss - HP 

Turbine blade failure. High 

(Takeoff Power)

Turbine blade failure (high 

pressure)

N Y N N N N Y N LOUD BANG (COMPRESSOR SURGE) & 

POWERLOSS

Surge/Powerloss - Birdstrike. BIRDSTRIKE - 

POWERLOSS

U Y U N N N U N COMPRESSOR SURGE 

COMPRESSOR SURGE N Y Y N N N U N COMPRESSOR SURGE, AIRPLANE 

SHUDDER, FLASH OF LIGHT

COMPRESSOR SURGE U Y U N N N U N COMPRESSOR SURGE + VISUAL SIGHTING 

OF BIRDS, SURGES ON NO.2&3 ENGINES

Powerloss - Bird ingestion. 

High (Takeoff Power). 

POWERLOSS (BIRD 

INGESTION)

U Y U N N N U N POWERLOSS 

FIRE WARNING N Y Y N N N U N FIRE WARNING 

Surge/Compressor Stall - CIT 

SENSOR COLDSHIFT. High 

(Takeoff Power).

CIT SENSOR COLDSHIFT, 

CAUSED STALL

N Y Y N N N U N COMPRESSOR SURGE 

POWERLOSS - INTERNAL 

DISTRESS (SEIZED N2)

N Y Y N N N U N POWERLOSS 

Surge - Birdstrike/Compressor 

Stall. High (Takeoff Power).

BIRD INGESTION Y Y U N N N U N COMPRESSOR SURGE 

Surge/Powerloss - Bird 

ingestion. High (Takeoff 

Power). 

BIRD INGESTION - 

POWERLOSS

U Y U N N N U N COMPRESSOR SURGE 

Surge/Powerloss - Bird 

ingestion. High (Takeoff 

Power). 

BIRD INGESTION - 

POWERLOSS

U Y Y N N N U N COMPRESSOR SURGE 

A-5
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

ID Number Event 

Class

PSM+ICR Category ICR Appears 

Intentional 

(Y/N/U)

PSM Symptom ICR Cause Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Contributin

Factor 

(Y/N/U)

91 55 91/EWB/2/I I RTO>V1 Y Vibration - severe. Powerloss? Severe Vibration. Unable (severe 

vib)

N N N 

92 60 92/EWB/4/I I RTO>V1 Y Surge/Overtemp Surge Effects. U N N N 

93 64 93/EWB/4/I-2 I RTO>V1 Y Surge. Surge Effects. U N N N 

95 75 95/MWB/2/I1I RTO>V1 Y Thrust Reverser Unlock Annunciation ICR? (Decision @V1). Thrust Reverser 

Unlock Annunciation. 

U N N N 

96 80 96/MWB/4/I I RTO>V1 Y Powerloss/Decel Stall Surge. Powerloss/Decel Stall Surge - Sense line 

leaking/open.

U N N N 

72 8 72/2ND/2/S S RTO>V1 Y Powerloss Powerloss U N N N 

75 12 75/2ND/3/S S RTO>V1 Y Powerloss (Perceived)/Airplane Decel Powerloss perceived/inferred from aircraft 

decel.

U N N N 

78 21 *78/EWB/4/S S RTO>V1 U Surge. Powerloss? Surge related effect(s). Unknown if 

Awareness/Annunciation of PSM (Engine 

Surge) or affected Engine(s) causal.

U N N N 

83 36 *83/EWB/4/S S RTO>V1 Y EGT Exceedance. EGT Exceedance. Y N N N 

88 49 *88/EWB/4/S S RTO>V1 Y Vibration. Powerloss? Fire Warning and lack of adequate Crew 

Coordination/Communication. 

U N N N 

76 14 76/EWB/3/I I RTO>V1 (@ Rotation) Y Surge Surge Effects. U N N N 

77 17 77/2ND/3/I I RTO>V1 (@ Rotation) Y Surge/Powerloss. Vibration. Eng Fail 

indication.

Surge related noise and powerloss. Engine 

Failure annunciation. 

U N N N 

91 56 91/MNB/2/I I RTO>V1 (@ Rotation) Y Surge. Surge related noise and yaw. U N N N 

81 28 *81/2ND/3/S S RTO>V1 (@ Rotation) Y Surge/Powerloss. Surge related noise and decreasing engine 

power indications. No 

Awareness/Annunciation of severity of PSM 

(Engine Surge). Multiple circumstantial and 

experiential factors in pilot decision

Y N N N 

88 52 *88/MNB/2/S S RTO>V1 (@ Rotation) Y Surge. Powerloss? Surge related noise - misidentified failure 

(Tire vs Eng). No Awareness/Annunciation of 

PSM (Engine Surge) or affected Engine(s).

N - (All Normal) N N N 

95 76 *95/EWB/3/S S RTO>V1 (@ Rotation) Y Surge/Powerloss. Vibration and Airframe 

Shudder.

Surge related noise and vibrationmisidentified failure? No 

Awareness/Annunciation of PSM (Engine 

Surge & Powerloss) or affected Engine(s).

U N N N 

70 4 70/2ND/2/H H RTO>V1 (After Liftoff) Y Surge/Powerloss. Misread normal unaffected eng Indcations. 

Thought both engines failed? No 

Awareness/Annunciation of PSM (Engine 

Surge) Affected Engine(s).

Y Y N N 

86 46 *86/EWB/2/H H RTO>V1 (After Liftoff) Y Surge. Powerloss. Heavy Vibration. Unknown - Bang? No 

Awareness/Annunciation of PSM (Engine 

Surge) or Affected Engine(s)?

N N N N 

93 65 93/MWB/3/I I RTO>V1 Attempted. F/O attempted 

RTO/throttled engines. Captain 

intervened and continued takeoff.

Y Surge. Vibration. Surge Effects. Vibration. U N N N 

A-6
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

91 55

92 60

93 64

95 75

96 80

72 8

75 12

78 21

83 36

88 49

76 14

77 17

91 56

81 28

88 52

95 76

70 4

86 46

93 65

Recommended Propulsion 

Detection/Investigation/Study 

PSMs

Propulsion System 

Malfunction/Failure

PSM 

Recoverabl

e (Y/N/U)

Eng 

Ind 

Avail 

(Y/N/U)

Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

PSM 

Thrust 

Asym 

Awareness 

(Y/N/U)

A/P 

Engaged 

(Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Engage

d 

(Y/N/U)

A/T 

Contributing 

Factor 

(Y/N/U)

Engine Symptom 

Vibration/Powerloss - Tire 

ingestion. High (Takeoff 

Power). 

TIRE TREAD INGESTION N Y Unable (severe 

vib)

N N N U N SEVERE VIBRATIONS & PERCEIVED 

POWERLOSS

Surge - FAN BLADE 

FRACTURES (BIRD STRIKE). 

High (Takeoff Power).

BIRD INGESTION U Y U N N N U N COMPRESSOR SURGE 

Surge - BIRD STRIKE. High 

(Takeoff Power).

FAN BLADE FRACTURES 

(BIRD STRIKE)

N Y U N N N U N COMPRESSOR SURGE 

THRUST REVERSER 

UNSTOW INDICATION

U Y U N N N U N THRUST REVERSER "REV UNLK" LIGHT ON 

Powerloss/Decel Stall Surge 

High (Takeoff Power) 

CONTROL SYSTEM FAULT N U U N N N U N POWERLOSS + DECEL STALL/SURGE 

TEMPORARY POWER 

LOSS THEN RECOVERED 

FULLY

Y Y U N N N U N TEMPORARY POWERLOSS DUE TO 

STANDING WATER INGESTION DURING T/O

NONE Y Y U N N N U N SUPECTED POWER LOSS DUE TO AIRCRAF

DECELERATION

Surge. High (Takeoff Power). TIRE TREAD INGESTION U Y U N N N U N COMPRESSOR SURGE 

TURBINE BLADE 

RETAINER FAILURE

N Y Y N N N U N EGT WARNING (AMBER AND RED) 

CASE RUPTURE N Y U N N N U N FIRE WARNING 

Surge/Compressor Stall. High 

(Takeoff Power).

COMPRESSOR SURGE U Y U N N N U N COMPRESSOR SURGE 

Surge (Compressor 

stall)/Powerloss - 

DETERIORATION. High 

(Takeoff Power) 

DETERIORATION N Y U N N N U N COMPRESSOR SURGE 

Surge - COMPRESSOR 

LINER DISTRESS. High 

(Takeoff Power) 

COMPRESSOR LINER 

DISTRESS

N Y U N Y N N U N COMPRESSOR SURGE 

Surge - Recoverable. High 

(Takeoff Power).

POWERLOSS - REPORTED 

AS PARTIAL

Y Y Y N Y N N U N COMPRESSOR SURGE 

Surge - TURBINE BLADE 

FAILURE. High (Takeoff) 

Power.

TURBINE BLADE FAILURE N Y N - (All Normal) N N N N U N COMPRESSOR SURGE 

Surge. Powerloss - HPC 

BLADE SEPARATION. High 

(Takeoff Power) 

HPC BLADE SEPARATION 

RESULTING FROM FOD

N Y U N N N U N COMPRESSOR SURGE 

Surge. Powerloss - Turbine 

blade failure. High (Takeoff 

Power)

POWERLOSS - TURBINE 

BLADE FAILURE

N Y Y Y Y N N U N COMPRESSOR SURGE 

Surge. Powerloss - Fan blade 

fracture/Bird ingestion. High 

(Takeoff Power). 

FAN BLADE FRACTURE - 

BIRD INGESTION

N Y N N N N U N COMPRESSOR SURGE (POWERLOSS) 

Surge. High (Takeoff Power). COMPRESSOR SURGE Y Y U N N N U N COMPRESSOR SURGE 

A-7
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

ID Number Event 

Class

PSM+ICR Category ICR Appears 

Intentional 

(Y/N/U)

PSM Symptom ICR Cause Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Contributin

Factor 

(Y/N/U)

89 53 *89/MNB/2/H

F

HF SHUTDOWN GOOD ENGINE Y Surge Vibration (Airframe). No Awareness/Annunciation of PSM (Engine 

Surge) or Affected Engine.

N N N N 

70 5 70/EWB/4/I I SHUTDOWN GOOD ENGINE N Fire Warning Unintended Fuel Control/Mgmt Error. U N N N

72 7 72/EWB/4/I-1 I SHUTDOWN GOOD ENGINE N Fire Warning Unintended FE Fuel Control/Mgmt Error. U N N N

72 9 72/EWB/4/I-2 I SHUTDOWN GOOD ENGINE Y Powerloss/Surge Crew misinterpreted rising EGT. No 

Awareness/Annunciation of PSM (Engine 

Surge) or Affected Engine(s).

Y Y N N 

75 11 75/EWB/4/I-1 I SHUTDOWN GOOD ENGINE U Surge/EGT Rising Eng #3 N1 decreasing. No 

Awareness/Annunciation of PSM (Engine 

Surge) Affected Engine.

Y N N N 

75 13 75/EWB/4/I-2 I SHUTDOWN GOOD ENGINE U Surge. Unknown. Pilot error or FE fuel mgmt error? N N N N

77 15 77/EWB/4/I I SHUTDOWN GOOD ENGINE U Surge/Powerloss/Quit Running. No Awareness/Annunciation of PSM (Engine 

Surge) or Affected Engine. ICR Suspected.

U N N N 

78 18 78/2ND/3/I-1 I SHUTDOWN GOOD ENGINE U Powerloss/Fail-Quit #3 Unknown. Crew error during restart 

procedure suspected. ICR Suspected. 

U N N N 

78 20 78/EWB/4/I I SHUTDOWN GOOD ENGINE N Powerloss Unintended FE? Error - S/D wrong/good 

engine during restart.

N N N N

79 23 79/EWB/4/I-1 I SHUTDOWN GOOD ENGINE N Surge/EGT Exceedance. Unintended FE Error - Fuel Heat mismgmt. N N N N

79 24 79/2ND/2/S I SHUTDOWN GOOD ENGINE Y Surge/DISINTEGRATION. Cabin 

Depressurization.

No Awareness/Annunciation of PSM (Engine 

Surge) or Affected Engine. Loss/zeroing of 

indications.

U N N N 

80 25 80/EWB/3/I I SHUTDOWN GOOD ENGINE U Fail/Subidle. NO RESPONSE TO 

THROTTLE

Unknown. N N N N

81 26 81/2ND/2/I I SHUTDOWN GOOD ENGINE U Powerloss Unknown. ICR Suspected. U U N N 

81 31 81/EWB/4/I I SHUTDOWN GOOD ENGINE U Powerloss Crew Error. U N N N 

82 33 82/EWB/4/I I SHUTDOWN GOOD ENGINE N Vibration. AVM and Vibration Alert Eng 

#2

Unintended FE Error - Pulled wrong fire 

handle - eng #1.

N N N N

85 41 85/EWB/4/I-2 I SHUTDOWN GOOD ENGINE Y Surge. Crew misinterpreted fuel Flow drop due to 

throttle cut on good engine - TWO-ENG OUT. 

Crew Coordination/communication.

Y N N U 

85 42 85/MWB/2/I I SHUTDOWN GOOD ENGINE Y Surge Vibration (Airframe). No Awareness/Annunciation of PSM (Engine 

Surge) or Affected Engine.

U N N N 

93 63 93/EWB/4/I-1 I SHUTDOWN GOOD ENGINE Y Surge/EGT Exceedances. ICR? - ICR Assumed. EGT Exceedances. Y N N N 

93 66 *93/MNB/2/I I SHUTDOWN GOOD ENGINE Y STUCK THROTTLE - @ Medium 

(Approach) Power

No Awareness/Annunciation of Stuck 

Throttle. Crew misinterpreted idle eng as 

flameout.

Y U N Y 

94 71 *94/MWB/4/I I SHUTDOWN GOOD ENGINE Y Powerloss/Surge (Crew induced) Crew misinterpreted falling engine indications 

as Failure.

Y N N N 

A-8
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

89 53

70 5

72 7

72 9

75 11

75 13

77 15

78 18

78 20

79 23

79 24

80 25

81 26

81 31

82 33

85 41

85 42

93 63

93 66

94 71

Recommended Propulsion 

Detection/Investigation/Study 

PSMs

Propulsion System 

Malfunction/Failure

PSM 

Recoverabl

e (Y/N/U)

Eng 

Ind 

Avail 

(Y/N/U)

Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

PSM 

Thrust 

Asym 

Awareness 

(Y/N/U)

A/P 

Engaged 

(Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Engage

d 

(Y/N/U)

A/T 

Contributing 

Factor 

(Y/N/U)

Engine Symptom 

Surge/FAN BLADE 

FRACTURE. Vibration. 

Medium to Low (Cruise, 

Descent, & Approach) Power.

FAN BLADE FRACTURE N Y N N U N U N COMPRESSOR SURGE, MODERATE TO 

SEVERE VIBRATION, BURNING SMELL, AND 

SOME VISIBLE SMOKE IN CABIN

PNEUMATIC BLEED DUCT 

RUPTURE

N Y U N U N U N FIRE WARNING 

NACELLE FIRE - FUEL 

LEAK FROM Wf 

TRANSMITTER

N U U N U N U N FIRE WARNING 

Surge/Airflow Related. Cruise 

Power.

HPT BLADE FAILURE N Y Y Y U N U N COMPRESSOR SURGE 

Engine x 

Surge/COMPRESSOR 

DETERIORATION. Medium 

(Cruise) Power.

COMPRESSOR 

DETERIORATION

Y Y Y N U N U N COMPRESSOR SURGE 

NO CAUSE FOUND, 

ENGINES CHECKED OK

Y Y N N U N U N HI STAGE BLEED LIGHT, COMPRESSOR 

SURGE

Surge/Internal Eng Damage. 

Surge/Airflow Related. Climb 

Power. 

COMPRESSOR SURGE N Y U N U N U N COMPRESSOR SURGE 

Powerloss/GEAR SHAFT 

FAILURE. High (Climb) 

Power.

GEAR SHAFT FAILURE N Y U N U N U N POWERLOSS 

POWERLOSS (HPC HUB 

FAILURE)

N Y N N U N U N COMPRESSOR SURGE 

POWERLOSS Y Y N N U N U N COMPRESSOR SURGE AND OVERTEMP 

Surge/HPC 

DISINTEGRATION. Powerloss 

- Thrust Shortfall/Subidle? 

Medium (Cruise) Power 

event.DISINTEGRATION - 

HPC DISK

DISINTEGRATION - HPC 

DISK

N Y - 

Mislea

ding - 

all zero 

except 

EGT.

U N U N U N COMPRESSOR SURGE 

ROLLED BACK SUB-IDLE N Y N N Y N U N NO RESPONSE TO THROTTLE 

Eng Fail - Thrust 

Shortfall/Subidle. High Power.

FUEL PUMP SHAFT 

FAILURE

N Y U U N N U N POWERLOSS 

Powerloss? Medium (Cruise) 

Power.

POWERLOSS U U U N U N U N POWERLOSS 

POWERLOSS - LP 

LOCATION BEARING 

FAILURE

N Y N N U N N N COMPRESSOR SURGE 

Surge/Metal in Tailpipe 

Damage. Highw (Climb) 

Power.

COMPRESSOR SURGE - 

MITP

N Y Y N U N U U COMPRESSOR SURGE 

Surge/HPC Damage. 

Vibration. Meduim to Low 

(Cruise and Descent) Power.

HIGH PRESSURE 

COMPRESSOR FOD

Y U U N U N U N COMPRESSOR SURGE 

NOSE SPINNER 

SEPARATION

U Y Y N U N U N COMPRESSOR SURGE 

THROTTLE STUCK Y Y Y U U N Y Y STUCK THROTTLE 

Surge/Stator Vane Hysteresis. 

High Power.

COMPRESSOR SURGE Y Y Y N U N Y N COMPRESSOR SURGE 

A-9
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

ID Number Event 

Class

PSM+ICR Category ICR Appears 

Intentional 

(Y/N/U)

PSM Symptom ICR Cause Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Contributin

Factor 

(Y/N/U)

95 73 *95/MWB/2/I2I SHUTDOWN GOOD ENGINE Y STUCK THROTTLE - @ High (94%) 

Power

No Awareness/Annunciation of Stuck 

Throttle. Crew misinterpreted vibration, 

decreasing eng parameters, and idle eng as 

failure.

Y Y N Y 

96 79 96/MNB/2/I I SHUTDOWN GOOD ENGINE Y STUCK THROTTLE - @ Idle Power No Awareness/Annunciation of Stuck 

Throttle. Crew misinterpreted thrust 

asymmetry and idle eng as flameout.

U Y N Y 

93 67 *93/EWB/2/I I THROTTLED GOOD ENGINE U Surge. Unknown - Could not determine which engine 

was surging?

U U-Possible N TBD 

94 69 *93/MWB/2/I3I THROTTLED GOOD ENGINE Y Surge. Unknown - Could not determine which engine 

was surging?

U U-Possible N TBD 

94 70 94/MWB/2/I2

I THROTTLED GOOD ENGINE U Surge. Unknown - Could not determine which engine 

was surging?

U U-Possible N TBD 

94 72 94/MWB/2/I1I THROTTLED GOOD ENGINE Y Surge. Unknown - Could not determine which engine 

was surging?

U U-Possible N TBD 

69 2 69/2ND/2/H H THROTTLED GOOD ENGINE - 

FORCED LANDING

Y Surge. Could not determine which engine was 

surging.

U N N N 

A-10
TABLE A-1. INDICATIONS OF PROPULSION SYSTEM MALFUNCTIONS

Year Event 

#

95 73

96 79

93 67

94 69

94 70

94 72

69 2

Recommended Propulsion 

Detection/Investigation/Study 

PSMs

Propulsion System 

Malfunction/Failure

PSM 

Recoverabl

e (Y/N/U)

Eng 

Ind 

Avail 

(Y/N/U)

Eng Ind/Ann 

Use 

Contributing 

Factor (Y/N/U)

Thrust Asym 

Contributing 

Factor (Y/N/U)

PSM 

Thrust 

Asym 

Awareness 

(Y/N/U)

A/P 

Engaged 

(Y/N/U)

A/P 

Contributing 

Factor 

(Y/N/U)

A/T 

Engage

d 

(Y/N/U)

A/T 

Contributing 

Factor 

(Y/N/U)

Engine Symptom 

THROTTLE 

STUCK/JAMMED

N Y Y Y Y N Y Y STUCK THROTTLE 

STUCK THROTTLE Y Y U Y Y Y N Y Y STUCK THROTTLE 

Surge. High (Takeoff) Power. COMPRESSOR SURGE Y Y U U-Possible U N U TBD COMPRESSOR SURGE 

Surge. High (Takeoff) Power. COMPRESSOR SURGE Y Y U U-Possible U N U TBD COMPRESSOR SURGE 

Surge. High (Takeoff) Power. COMPRESSOR SURGE U Y U U-Possible N N U TBD COMPRESSOR SURGE 

Surge. High (Takeoff) Power. COMPRESSOR SURGE Y Y U U-Possible U N U TBD COMPRESSOR SURGE 

Surge/HP TURBINE SEAL 

FAILURE. High (Takeoff) 

Power.

HP TURBINE SEAL 

FAILURE

N Y U N U N U N COMPRESSOR SURGE 

A-11/12
APPENDIX B—HUMAN FACTORS MONITORING FRAMEWORK

B-1
Appendix B: Monitoring Framework 

Indications (in addition to controls) are key elements of the interface and support a range 

of flight crew tasks. Because the flight deck interface offers more information than a 

flight crew can see at one time, they must allocate their attention to the various elements 

of the interface in an appropriate and efficient way. Flight crew training and operational 

policy provide guidance concerning which indications to monitor at what times, but the 

days of the simple, basic “T” are gone—much more information is available on the 

interface—and monitoring is a complex task. The following sections offer a framework 

for describing flight crew monitoring—more specifically, to describe where a crew is 

likely to be looking and to ensure that monitoring processes are supported. 

In the following, we do not indicate which pilot is the one monitoring. Generally, we are 

assuming a two-person crew with a pilot flying (PF) and pilot not flying (PNF). The PF 

is the pilot primarily involved in performance monitoring, and the PNF is more involved 

in the periodic scanning related to health monitoring. 

B.1 Primary Monitoring Drivers 

There are three primary initiators of flight crew monitoring: 

- Task requirements (from a crew-initiated task) 

- Routine scan 

- Detecting a change 

Task requirements. The flight crew is often engaged in control activities that require 

feedback through the interface, which is performance monitoring. For example, if a pilot 

is flying the airplane manually or to flight director (FD) guidance, he/she needs to 

monitor attitude, altitude, airspeed, heading, path, and thrust setting to ensure that flight 

targets are being achieved. The primary flight display (PFD) in modern “glass cockpits” 

brings together most but not all of these indications so the pilot can get immediate 

feedback on how well he/she is controlling. Or, a pilot may be conducting an engine start 

and seeking feedback on engine response. At these times, then, monitoring (attention) is 

directed to a specific area of the interface and a specific set of indications, which are a 

small subset of available indications. 

Routine scan. Pilots scan a wide range of indications periodically to ensure that the state 

of the airplane is as expected; this may serve either performance or health monitoring. 

For example, even when flying and focused on the PFD and ND, a pilot must also 

periodically glance at the engine indications and at the EICAS area to ensure that no 

important changes have occurred in those areas. At other times, pilots conduct routine 

scans (or flows) through a set of controls and indications before or after taking certain 

actions, such as thrust setting or engine start. Thus, pilots are directing attention to a set 

of indications and/or controls in succession. 

B-2
Detect change. In the first two cases, pilots are consciously directing their attention to

indications. In this third case, salient changes “attract” attention; the flight crew 

“detects” a change. Changes in interface alerting devices (e.g., master warning light), or 

message areas (e.g., EICAS message popping up), color changes or flashing (e.g., an 

indication changing to red), or “pop up” display of indications can attract attention and 

orient monitoring to a new set of indications. This is tied to health monitoring. 

B.2 The Situation Model 

The conscious direction of attention (task requirements and routine scan) is driven by a 

model in the pilot’s mind. That is, a pilot has expectations about how each system—and, 

therefore, each indication—will behave. The overarching model driving these 

expectations is called a situation model (ref, 19xx); this model represents the pilot’s 

current understanding of the state of the airplane and the environment it is operating in. 

More specifically, the pilot has some level of expectation about the current state of the 

weather, the terrain, the airplane systems, airplane health, the current role of autoflight 

and the flight plan, etc. 

Situation Model

Mental Model:

Engine Indications

Mental Model:

Weather

Mental Model:

Fuel System Mental Model:

Engine

Information about the

State of the World

Situation Model

Mental Model:

Engine Indications

Mental Model:

Weather

Mental Model:

Fuel System Mental Model:

Engine

Information about the

State of the World

Figure B1. Situation model and supporting mental models (and inputs from

the world) 

As Figure B1 shows, the situation model depends on the pilot’s understanding of each 

system, as characterized by mental models (a sample of possible mental models is 

shown). A mental model is a person’s mental representation of a system or device that 

allows them to reason about how it will behave or respond to inputs given its current

state. For example, if a flight control action is taken, a pilot can reason about how the 

airplane will change attitude, altitude, speed, direction, etc. Note that typically a person’s 

mental model is not a perfect representation of the system; it is typically a simplification 

that can contain misconceptions and factual flaws. As this figure also shows, there needs 

to be input about the current state of the world. Pilot monitoring of the world brings in 

this information (this element is implied in the remaining figures). 

The pilot develops these mental models over time through training and experience with 

the systems, through study, or through discussing the system with others. As the pilot 

B-3
flies, he/she creates a situation model using his/her current understanding of the 

environment, the actions taken on the system, and system responses as inputs to the 

mental models. Thus, as mentioned, the situation model also depends on information 

about the current state of world (through monitoring, which is deliberate, and detection, 

which is more passive). The situation model is updated as new information accrues, and 

the pilot maintains an awareness of airplane state. Obviously, the situation model doesn’t 

capture all elements of the world, and no pilot has complete awareness (and complete 

awareness is not desirable). 

 

Initiating

Event

Routine Scan

Detect

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

Task

Initiating

Event

Routine Scan

Detect

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

Task

Figure B2. Monitoring uses the situation model to generate expectations 

about indications. 

The point is that this situation model drives expectations about what should be 

happening. For example, from the situation model, the pilot will expect N2 to increase 

after the engine start sequence has been initiated, and then will expect fuel flow and EGT 

to rise after the fuel control switch is selected on. To confirm that engine start is 

progressing smoothly, the pilot will direct attention to (i.e., monitor) relevant parameters

expecting to see them behave in expected ways. Figure B2 shows that monitoring, no 

matter how it is initiated, first uses the situation model to develop expectations about 

what indication behavior is expected. 

B-4
B.3 Monitoring Processes 

Figure B3 and B4 show the range of specific monitoring processes that need to be 

considered, starting with those tied to crew-initiated tasks in Figure B3. The following 

describe monitoring processes M1 through M5. 

Initiating

Event

Task

Monitoring Process:

M1. action; then confirm actual = commanded (primary)

M2. action; then confirm values = expected (secondary)

M3. action; then confirm expected behaviors (same engine)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

Situation Model

Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

feedback to Situation Model

expectations

Initiating

Event

Task

Monitoring Process:

M1. action; then confirm actual = commanded (primary)

M2. action; then confirm values = expected (secondary)

M3. action; then confirm expected behaviors (same engine)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

Situation Model

Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

feedback to Situation Model

expectations

Figure B3. Monitoring processes tied to flight crew tasks. 

- M1: action; then confirm actual = commanded (primary)

The pilot takes an action to directly affect some parameter. Specifically, the pilot 

sets a commanded value. The pilot then monitors to confirm that the actual 

parameter value goes to the commanded value in the expected period of time. 

The pilot will have a general expectation, and may have a detailed understanding 

of how the actual parameter will change to meet the command. 

For example, the pilot commands a thrust setting with the thrust levers, and 

monitors to confirm that N1 increases to meet that value, or the pilot selects fuel 

control switch on for start and monitors that fuel flow occurs. 

- M2: action; then confirm values = expected (secondary)

The pilot takes an action and has expectations about how that action will 

influence secondary indications (indications that he/she is not attempting to 

control directly). The pilot then monitors to confirm that these parameter values 

are as expected. 

For example, the pilot selects fuel control switch off for shutdown and monitors 

that some engine indications fall to zero. 

- M3: action; then confirm expected behaviors (same engine)

In some cases, the pilot is not monitoring for a specific value but is looking for an 

indication (or set of indications on the same engine) to behave in a certain way 

B-5
(e.g., increase rapidly, remain stable, increase and then level off). Monitoring is 

directed toward confirming that these behaviors occur. 

For example, the pilot starts the engine doing a manual start procedure, selects 

fuel control switch on and monitors that EGT, oil pressure, oil temperature, and 

N2 increase and stabilize. Monitoring serves to confirm that a set of parameters 

on the same engine respond in expected ways. 

- M4: action; then confirm same values/ behaviors (across engines)

Generally, both (all) engines should either change in unison or one should 

converge to the other(s). Thrust levers are typically set to the same value and 

engine performance should be symmetrical. In this case, the pilot takes an action 

and monitors to confirm that the two engines behave the same way. 

For example, the pilot sets the thrust levers to a higher or lower value and 

monitors that N1 or EPR values are close in value. Or, during engine start, the 

pilot monitors that parameters on the starting engine converge to those of the 

already running and stable engine. 

- M5: observe event; then take action 

The pilot knows that as tasks are being conducted, certain actions are triggered by 

indications (more generally, events). During normal or non-normal operations, 

there are pilot actions that are triggered by a parameter reaching a stable value or 

crossing a threshold. As a pilot is conducting a task, he/she is aware of how 

indications can reveal that a problem has occurred. In either case, monitoring 

serves to identify the event that triggers a required pilot action.

For example, during a manual start, as an engine start is proceeding, the pilot 

monitors engine speed to select fuel flow on at the appropriate point, and monitors 

EGT since abnormally high EGT indicates a hot start and the need for a pilot 

action. 

Initiating

Event

Routine Scan

Detect

M6. PF/Automation action; confirm actual = commanded

M7. given situation; confirm values = expected

M8. given situation; confirm expected behaviors

M9. given situation; confirm same values/behaviors across engines

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

normal?

invalid?

expectations

feedback to

Situation Model

unexpected

Monitoring Process:

Initiating

Event

Routine Scan

Detect

M6. PF/Automation action; confirm actual = commanded

M7. given situation; confirm values = expected

M8. given situation; confirm expected behaviors

M9. given situation; confirm same values/behaviors across engines

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

normal?

invalid?

expectations

feedback to

Situation Model

unexpected

Monitoring Process:

Figure B4. Monitoring processes tied to routine scan and detection. 

B-6
Figure B4 shows the specific monitoring processes tied to routine scanning and detection 

of change. The following describe monitoring processes M6 through M9. 

- M6: PF/Automation action; confirm actual = commanded 

Another agent (pilot flying or autopilot) takes an action, and the pilot monitors to 

confirm that the actual value goes to the commanded value. Monitoring is not 

part of the control task since the pilot is not controlling, but a check on whether 

the airplane is responding appropriately in the current situation. 

For example, the autothrottle commands a thrust increase to climb from a level 

segment, and the pilot monitors to confirm that N1 increases to meet the 

commanded value. 

- M7: given situation, confirm values = expected 

As a routine flight proceeds, the pilot generates expectations about the specific 

value of one or more airplane indications. Monitoring routinely will check 

current values against these expectations. 

For example, the pilot will have expectations concerning altitude, airspeed, stable 

and symmetric engine thrust and no non-normal indications being “pushed to the 

pilot.” 

- M8: given situation, confirm expected behaviors 

In some cases, the pilot’s expectations for a situation are about the behavior of 

one or more indications. Monitoring is used as a routine check to confirm that 

parameters are trending as expected. 

For example, as the flight progresses, thrust and fuel flow for a given airspeed 

will decrease as weight decreases, airplane CG will shift, oil quantity may 

decrease, etc. Other parameters are expected to remain constant/unchanging. 

Routine monitoring is used to check that these values are behaving as expected. 

- M9: given situation, confirm same values/behaviors across engines 

As mentioned above, generally both (all) engines should behave in parallel. In 

this case, the pilot has expectations that the engines will behave similarly, and the 

routine scan monitoring is used to ensure that parameters are consistent across 

engines. 

For example, a routine scan may reveal that oil pressure is significantly higher on 

engine 1 than on engine 2, which is unexpected and leads the pilot to try to 

understand why this might be the case. 

As mentioned above, generally both (all) engines should behave symmetrically. In 

this case, the pilot has expectations that the engines will behave similarly, and the 

routine scan monitoring is used to ensure that parameters are consistent across 

engines. For example, a routine scan may reveal that EGT is significantly higher on 

engine 1 than on engine 2, which is unexpected and leads the pilot to try to 

understand why, and then assess the potential system, airplane, and mission effects. 

B-7
Notice that Figure B4 also considers the possibility that monitoring uncovers an 

unexpected indication (bubble in the upper right corner). In this case, the pilot must 

determine if this outcome is really normal (what he/she should have expected) or invalid 

(due to some failure, such as a sensor failure). These possibilities create the need for two 

additional initiators of monitoring (see Figure B5). 

Initiating

Event

Routine Scan

Detect

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

expectations

feedback to

Situation Model unexpected

Task

Monitoring Process:

M1. action; then confirm actual = commanded (primary)

M2. action; then confirm values = expected (secondary)

M3. action; then confirm expected behaviors (same engine)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

M6. PF/Automation action; confirm actual = commanded

M7. given situation; confirm values = expected

M8. given situation; confirm expected behaviors

M9. given situation; confirm same values/behaviors across engines

Pursue Unexpected

Troubleshoot

normal?

invalid?

Initiating

Event

Routine Scan

Detect

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

expectations

feedback to

Situation Model unexpected

Task

Monitoring Process:

M1. action; then confirm actual = commanded (primary)

M2. action; then confirm values = expected (secondary)

M3. action; then confirm expected behaviors (same engine)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

M6. PF/Automation action; confirm actual = commanded

M7. given situation; confirm values = expected

M8. given situation; confirm expected behaviors

M9. given situation; confirm same values/behaviors across engines

Pursue Unexpected

Troubleshoot

normal?

invalid?

Figure B5. Other initiating events for monitoring 

Pursue unexpected findings. In the case that monitoring reveals an unexpected 

indication, the pilot must determine what is happening with the airplane; this finding, 

therefore, may initiate new monitoring. From the initial unexpected indication, 

hypotheses are generated (using the mental models) about what might be happening. 

These hypotheses are further used to generate expectations about other indications, and 

monitoring commences to determine the actual values of other indications. This 

monitoring activity can either reveal a problem (e.g., failure) that is causing the 

unexpected indications, or it may suggest that the initial unexpected indication is not a 

valid indication. Note that, due to inaccurate or incomplete mental models, the flight

crew may reach an incorrect conclusion. 

Troubleshoot. An alternative approach—which may be rarely used—when confronted 

with unexpected indications (or concerns about airplane performance) is to engage in 

troubleshooting activities. In this case, the pilot has a concern about a system and takes 

control actions with known effects (determined from the mental models). Monitoring is 

used to confirm that the system responds as expected to the control actions. Through this 

type of experimentation and confirmation, the pilot attempts to learn something about the 

B-8
nature of the unexpected indication. Again, due to inaccurate or incomplete mental 

models, the flight crew may reach an incorrect conclusion. 

B.4 Example Monitoring Cases 

Case 1: Thrust setting. Figure B6 offers an example of how this monitoring framework 

allows one to trace and describe pilot behavior. The red boxes and arrows illustrate pilot 

behavior in the case of thrust setting. At box 1, “initiate new thrust setting,” the pilot 

initiates a task of commanding to a new thrust target. This action, through the situation 

model, generates expectations (box 2) about what indications will change and how they 

will change. From these expectations, the pilot monitors the N1 indication to confirm 

that the actual N1 value meets the commanded value (box 3). The expected result occurs, 

and the situation model is updated with the new thrust value (box 4). 

Initiating

Event

Routine Scan

Detect

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

unexpected

Pursue Unexpected

Troubleshoot

normal?

invalid?

Monitoring Process:

M2. action; then confirm values = expected (secondary)

M3. action; then confirm expected behaviors (same engine)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

M6. PF/Automation action; confirm actual = commanded

M7. given situation; confirm values = expected

M8. given situation; confirm expected behaviors

M9. given situation; confirm same values/behaviors across engines

Initiating

Event

Routine Scan

Detect

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

unexpected

Pursue Unexpected

Troubleshoot

normal?

invalid?

Monitoring Process:

M2. action; then confirm values = expected (secondary)

M3. action; then confirm expected behaviors (same engine)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

M6. PF/Automation action; confirm actual = commanded

M7. given situation; confirm values = expected

M8. given situation; confirm expected behaviors

M9. given situation; confirm same values/behaviors across engines

Task

1 initiate new thrust setting

2 generate expectations about indications

3 monitor N1 to determine if actual = commanded

4 update situation model

M1. action; then confirm actual = commanded (primary)

Task

1 initiate new thrust setting

2 generate expectations about indications

3 monitor N1 to determine if actual = commanded

4 update situation model

M1. action; then confirm actual = commanded (primary)

Figure B6. Case 1: Thrust setting. 

B-9
Initiating

Event

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

unexpected

Task

Troubleshoot

normal?

invalid?

Monitoring Process:

M1. action; then confirm actual = commanded (primary)

M2. action; then confirm values = expected (secondary)

M3. action; then confirm expected behaviors (same engine)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

M6. PF/Automation action; confirm actual = commanded

M8. given situation; confirm expected behaviors

Initiating

Event

Situation Model Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

unexpected

Task

Troubleshoot

normal?

invalid?

Monitoring Process:

M1. action; then confirm actual = commanded (primary)

M2. action; then confirm values = expected (secondary)

M3. action; then confirm expected behaviors (same engine)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

M6. PF/Automation action; confirm actual = commanded

M8. given situation; confirm expected behaviors

Routine Scan

Detect

Pursue Unexpected

1 conduct routine scan of

engine indications:

get Eng 1 EGT

2 generate expectations about value

3 EGT value is greater than expected

7 notice EGT from Eng 2 is much lower

4 update situation model;

get more targeted reference

5 determine if value is abnormal or invalid

6 generate expectations about other values

M7. given situation; confirm values = expected

M9. given situation; confirm same values/behaviors across engines

Routine Scan

Detect

Pursue Unexpected

1 conduct routine scan of

engine indications:

get Eng 1 EGT

2 generate expectations about value

3 EGT value is greater than expected

7 notice EGT from Eng 2 is much lower

4 update situation model;

get more targeted reference

5 determine if value is abnormal or invalid

6 generate expectations about other values

M7. given situation; confirm values = expected

M9. given situation; confirm same values/behaviors across engines

Figure B7. Case 2: Notice deviation in oil pressure. 

Case 2: Notice deviation in EGT. Figure B7 takes a more complex case. As part of a 

routine scan of engine indications (box 1), the pilot monitors the EGT value on engine 1. 

Using the situation model (which is unaware of any problems), the pilot generates an 

expectation about the EGT value (box 2). The pilot then notices that the observed EGT 

value is greater than expected (from the situation model) (box 3). The unexpected 

observation (box 4) leads the pilot to pursue it by monitoring in a more focused way (box 

5). Using the situation model, a determination is made to look at the same indication on 

engine 2 as a comparison (box 6). Finally (box 7), monitoring engine 2 reveals that there 

is a significant discrepancy between the EGT values on the two engines. This may 

prompt crew action. 

B-10
Initiating

Event

Situation Mod

Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

unexpected

Task

Pursue Unexpected

normal?

invalid?

Monitoring Process:

M1. action; then confirm actual = commanded (primary)

M2. action; then confirm values = expected (secondary)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

M6. PF/Automation action; confirm actual = commanded

M7. given situation; confirm values = expected

M9. given situation; confirm same values/behaviors across engines

Initiating

Event

Situation Mod

Mental Model:

Fuel System

Mental Model:

Weather

Mental Model:

Engine

Mental Model:

Engine Indications

unexpected

Task

Pursue Unexpected

normal?

invalid?

Monitoring Process:

M1. action; then confirm actual = commanded (primary)

M2. action; then confirm values = expected (secondary)

M4. action; then confirm same values/behaviors (across engines)

M5. observe event; then take action

M6. PF/Automation action; confirm actual = commanded

M7. given situation; confirm values = expected

M9. given situation; confirm same values/behaviors across engines

Routine Scan

Detect

el

Troubleshoot

1 hear loud noise from right side;

airplane yaws right.

2 generate hypotheses about cause.

possible engine surge?

4 see expected change in Eng 2;

update situation model;

is it recoverable?

3 look for evidence of surge on Eng 2

7 see Eng 2 behavior has returned to normal

5 reduce Eng 2 thrust to see effect

6 generate expectations about behavior

M3. action; then confirm expected behaviors (same engine)

M8. given situation; confirm expected behaviors

Routine Scan

Detect

el

Troubleshoot

1 hear loud noise from right side;

airplane yaws right.

2 generate hypotheses about cause.

possible engine surge?

4 see expected change in Eng 2;

update situation model;

is it recoverable?

3 look for evidence of surge on Eng 2

7 see Eng 2 behavior has returned to normal

5 reduce Eng 2 thrust to see effect

6 generate expectations about behavior

M3. action; then confirm expected behaviors (same engine)

M8. given situation; confirm expected behaviors

Figure B8. Case 3: Respond to a loud noise. 

Case 3: Respond to loud noise. Figure B8 illustrates a case in which monitoring is 

initiated by the detection of a change. The pilot hears a loud noise from the right side of 

the airplane, and the airplane yaws right (box 1). Because this noise was unexpected, the 

pilot must use the situation model to generate hypotheses about what may have happened 

(box 2). The primary candidate is that an engine surge occurred, which generates 

expectations about changes on the right engine. Monitoring reveals that right engine 

thrust is fluctuating significantly, EGT is rising, and engine vibrations are high (box 3). 

This confirms the hypothesis that an engine surge is occurring (box 4). Depending on 

past experience, circumstances, training, SOPs, and other factors, the crew may elect to 

shut the engine down. To further confirm surge and determine if it is recoverable, the 

pilot must take an action and then monitor the engine response (box 5). Reducing engine 

thrust leads to generating expectations about how engine 2 indications will behave (box 

6). In box 7, the pilot monitors and confirms that the engine is, or is not, responding in 

the expected manner. 

These three figures illustrate how monitoring is the pilot’s conscious direction of 

attention to specific indications. Each time, the pilot uses his/her understanding of the 

airplane, its systems, and the environment around it to generate expectations about the 

behavior or value of specific indications. Monitoring then closes that loop, when 

expectations are confirmed, or can initiate another loop when an unexpected indication is 

observed. 

B-11
The point of developing this framework is to aid in thinking about how indications can 

support the flight crew, how monitoring processes are influenced, where and how 

monitoring processes fail, and how they might be supported to better ensure the desired 

outcome—safe and efficient airplane missions. 

B-12
APPENDIX C—HUMAN FACTORS GUIDANCE ON FLIGHT DECK DESIGN

C-1
Appendix C: Human Factors Guidance on Flight Deck Design 

The following two sections provide some background on flight deck design guidance. 

The first section discusses pilot-centered (human-centered) design. The second section 

describes Rasmussen’s concept of skill-based, rule-based, and knowledge-based 

performance, which was referred to earlier in this report. 

C.1 Pilot-Centered Design 

The notion of human-centered design (or pilot-centered design in the case of airplanes) 

has come out of the discipline of cognitive engineering, which strives to design systems 

that are compatible with the cognitive requirements of systems operation (e.g., Norman, 

1986). Pilot-centered design has the following basic steps: 

1. define/describe operational tasks 

2. define the desired role of the pilot 

3. define the set of displays and controls (required information) needed to support 

pilots 

The first two steps go almost hand-in-hand as the designer defines the scope of 

operations: What tasks need to be accomplished for safe and efficient completion of the 

mission? This analysis might start with thinking about general functions that must be 

achieved. For example, for a flight crew to manage airplane systems, they must be able 

to 

- monitor the current state of relevant airplane and airplane system parameters 

- monitor the current values of each system parameter (perhaps with some 

exceptions) 

- detect “meaningful” changes in the state of each system or parameter 

- locate guidance for managing system faults 

- change a system’s state or configuration through component controls 

These are examples of the types of functions that need to be achieved. More specific task 

analysis would be required to specify fully a task list. 

The second step is to define the role of the pilot/flight crew. The designer needs to 

determine how the human operators will coordinate activities with the automated agents 

to carry out tasks. In particular, the designer needs to think about how the human 

resources will be spent and what the humans need to be engaged in. 

Some activities are very demanding for humans—for example, constant monitoring of 

parameter values requires a high level of vigilance, and humans are not very effective in 

this task. If humans are asked to monitor for subtle changes in a parameter, their 

attention is unavailable for other activities. Another consideration is what the automation 

hides. If the automation takes over processes completely, the flight crew is likely to be 

C-2
unaware of what is happening with those processes. For example, if the automation 

identifies a fault and then reconfigures a system to eliminate that fault, the human may 

have no knowledge of the change in that system. Thus, the designer needs to determine 

how the limited flight crew resources are going to be spent: What should they be 

engaged in? and What should they be aware of? 

C.2 Skill-Based, Rule-Based, and Knowledge-Based Performance 

Rasmussen (1986), in the context of a general model of human performance, described 

three levels: skill-based, rule-based, and knowledge-based. Figure C1 illustrates each of 

these. 

Monitor/Detect

Integrate/

Interpret

Plan Actions/

Select Response

Execute

skill-based

rule-based

knowledge-based

Monitor/Detect

Integrate/

Interpret

Plan Actions/

Select Response

Execute

skill-based

rule-based

knowledge-based Determine Goal/

Identify Task

Figure C1. Skill-Based, Rule-Based, Knowledge-Based Performance. 

Generally, Figure C1 captures Rasmussen’s performance model. Starting at the lower 

left, Figure C1 shows that task performance is composed of a series of cycles each of 

which involves elements of monitor, interpret, set goals, plan actions, and execute. More 

specifically, monitoring allows the gathering of data about a system’s components, which 

is integrated and interpreted in terms of a system description (or system fault). From this 

system description, the pilot must determine what goal needs to be addressed first (e.g., 

maintain altitude), and develop a response plan to meet this goal. The response plan is 

finally executed. Feedback from that execution, as well as continued monitoring of the 

system leads into the next cycle. This performance model makes a number of 

simplifying assumptions but serves as a useful organizing framework for discussing 

performance, from awareness to understanding to response. 

Figure C1 also breaks out Rasmussen’s three levels. In the lower green box are the 

components of skill-based performance. Skill-based performance is performance that 

takes place without conscious control; it involves smooth, automated, and highly 

C-3
integrated patterns of behavior. Simple examples can be taken from sports (catch a ball, 

volley a tennis ball), driving (steering a car through a curve), or flying (using rudders to 

steer the centerline during the take-off roll). The green box shows this performance as a 

direct link from monitoring to execution (or, get an input and respond). 

The blue box in Figure C1 shows rule-based performance, which is performance that is 

consciously controlled by a procedure or set of rules. Although individual behaviors may 

be skill-based, their performance is structured by a set of rules, which are often 

documented in a formal manner (e.g., checklist or procedure). The set of rules also 

captures the purpose or goal of performance (e.g., the procedure title). In Figure C1 

monitoring is followed by integration and interpretation (or understanding). 

Understanding leads to the selection of the appropriate set of action items, which are 

already defined, followed by execution of those actions. 

Knowledge-based performance, in red in Figure C1, uses the entire cycle and is reserved 

for unfamiliar or previously unanalyzed situations, where performance is generated from

the pilot’s reasoning process. Often, the goal of the task must be determined from an 

understanding of the situation, and individual behaviors must be identified out of an 

analysis of the goal. These cases are rare in commercial aviation, and much is done to 

avoid the need for this type of performance. However, it is important to remember that it

is not possible to anticipate every situation and develop a procedure for it. At some point 

a flight crew will be faced with the need for knowledge-based performance, and the flight 

deck interface should provide them tools to support it. 

C-4
APPENDIX D—PROPULSION SYSTEM MALFUNCTION CHARACTERIZATION DATA

D-1 
D-2

Figure D-1. PSM+ICR Event 94/MWB/4/I (Recoverable Event) 
D-3

Figure D-2. PSM+ICR Event 93/EWB/2/I - Parameters (Recoverable Event) 
D-4

Figure D-3. PSM+ICR Event 93/EWB/2/I - Conditions (Recoverable Event) 
D-5

Figure D-4. PSM+ICR Event 89/MNB/2/HF (Non-Recoverable Event) 
D-6

Figure D-5. PSM+ICR Event 89/MNB/2/HF (Non-Recoverable Event) 
D-7

Figure D-6. PSM+ICR Event 89/MNB/2/HF (Non-Recoverable Event) 
Figure D-7. PSM+ICR Event 91/MNB/2/H (Non-Recoverable Event) 

D-8
Analysis 

Type 

Analysis 

Priority 

Event 

# 

ID Number Event 

Class 

Hazard

Level 

PSM+ICR Category 

Data. Ops. High 53 *89/MNB/2/HF HF 5 SHUTDOWN GOOD 

ENGINE 

Data High 42 85/MWB/2/I I 1B SHUTDOWN GOOD

ENGINE 

Data. Ops. High 62 *93/MNB/2/I I 1B OTHER-COMPRESSOR 

SURGE; UNABLE TO 

ISOLATE WHICH 

ENGINE WAS AFFECTED

Data. Ops. Med-Hi 77 95/2ND/2/HF HF 5 LOSS OF CONTROL 

Data. Ops. Medium 56 91/MNB/2/I I 1B RTO 

Data. Ops. Medium 80 96/MWB/4/I I 2G RTO 

Data. Ops. Medium 71 *94/MWB/4/I I 2F SHUTDOWN GOOD 

ENGINE 

Data. Ops. Medium 52 *88/MNB/2/S S 3B RTO 

Table D-1. PSM+ICR Events of Interest 

D-9/D-10
APPENDIX E—TECHNICAL FEASIBILITY ENGINEERING STUDY

E-1
Note: This version of Impact Technologies’ Technical Report 

has been edited by The Boeing Company to remove 

proprietary flight test data. 

Technical Report No. P268-01-1 

TASK 5.2 Final Report 

April 29, 2002

Prepared for:

The Boeing Company 

P.O. Box 3707, MC 19-RL 

Seattle, WA 98124-2207 

Prepared by: 

_____________________________ 

Gregory J. Kacprzynski

Project Manager 

_____________________________ 

Andrea Palladino

Project Engineer 

_____________________________

Dr. Michael J. Roemer 

Director of Engineering

Impact Technologies, LLC www.impact-tek.com

Headquarters: 125 Tech Park Drive, Rochester, NY 14623 585.424.1990 • Fax: 585.424.1177

New Hampshire: 9 Gilson Road, West Lebanon, NH 03784 603.643.1876 • Fax: 603.643.1877

Pennsylvania: 220 Regent Court, Ste. A1, State College, PA 16801 814.861.6273 • Fax: 814.861.6276

E-2
EXECUTIVE SUMMARY

Under FAA contract DTFA03-01-R-00019 “Indications of Propulsion System Malfunctions”, 

The Boeing Company was tasked with the overall objective of improving characterization of 

Propulsion System Malfunctions and Inappropriate Crew Responses (PSM+ICR) and address the 

potential of improved Fleck Deck annunciations/indication of PSM events. Impact Technologies

LLC, was subcontracted to perform contract subtask 5.2 entitled “Data Acquisition and

Detection Methods”, which specifically focused on performing detailed technical evaluations of 

data-rich engine surge events. The focus on surge events was motivated by the fact that, from 

the AIA PSM+ICR report and data, 73% of the PSM events in these categories can be identified 

as either Power Loss or Surge [1]. Task 5.2 objectives were identified as follows: 

1. Analyze data representative of surge events 

2. Characterize any engine surge precursors 

3. Identify if and how recoverability of surge events can be determined 

4. Identify enhanced parameters, technical issues and health management methodologies 

for achieving objectives 2 and 3. 

Impact Technologies evaluated 5 sets of data. All of the data sets contained enhanced parameter sets at 

sampling frequencies of greater than or equal to 2Hz. The following accomplishments and 

generalizations were achieved as a result of detailed analysis of these data sets: 

1. Identified parameter sets and sampling rates for potentially improving surge detection 

confidence. 

2. Identified a methodology for quantifying surge risk initiated under design-limits surge 

subcategory.

3. Identified a potential methodology for assessing recoverability of a surge event/s (based on 

only one instance of non-recoverability)

4. Developed a Matlab/Simulink model for demonstrating the surge detection and recoverability 

algorithms derived from the data analysis. 

Detailed descriptions of the data analysis methodologies and conclusions are provided herein. 

E-3
OUTLINE 

BACKGROUND

DATA DESCRIPTIONS

REPORT ORGANIZATION

FIRST ENGINE DATA SETS

Event Identification and Description

Event Precursors

Recoverability

First Engine Conclusions

SECOND ENGINE-T405

Event Identification and Description

Event Precursors

Recoverability

Second Engine Conclusions

THIRD ENGINE – T102

Event Identification and Description

Event Precursors

Recoverability

Third Engine Conclusions

REQUIRED PARAMETERS

SURGE DETECTION AND RECOVERABILITY

CONCLUSIONS

DISCUSSION

REFERENCES

NOTES

Surge subcategories – Taken from Report 5.1

Characterizations of surge from PSM+ICR report – Taken from Report 5.1

SEDRA V1.0b Readme File

E-4
Background 

Tasks 2.1 and 5.1 entitled “In-service Data Assessment” and “Physical Characterization” 

respectively supported task 5.2. Task 2.1 was aimed at “acquiring and reviewing appropriate 

service information and report relevant to engine surge, thrust asymmetry, and engine fail 

conditions. Safety data was reviewed to determine whether lack of (or availability of) 

annunciated information led to in-service events” [2]. Task 5.1 was focused on “defining the

physical characteristics of propulsion system malfunctions of selected high priority safety 

concern scenarios identified through Task 2.1”[2].

Tasks 2.1 and 5.1 identified a group of incidents from the AIA PSM+ICR report [1] that are judged to 

have the greatest opportunity to provide meaningful, positive crew indication or alerts. This group of 

PSM events was placed into three high-level symptom identifier categories [2]:

Failed Commanded Pwr: The engine is unable to obtain commanded power (thrust) under 

engine control logic or with crew intervention and has failed to a 

power level that is not the maximum or minimum.

Failed High Power: The engine is unable to obtain commanded power (thrust) under engine 

control logic or with crew intervention and has failed to a state where it is 

producing maximum power (thrust) allowed by the engine control and/or 

fuel governor.

Failed Low Power: The engine is unable to obtain commanded power ( thrust) under 

engine control logic or with crew intervention and has failed to a 

state where it is producing minimum or no power (thrust), i.e. windmilling. 

73% of all the PSM events in these categories were identified as either Power Loss (Failed Low Power) or 

Surge and some of the Surge events were associated with a loss of power. Hence, it was determined that 

a technical evaluation of enhanced flight deck annunciations relative to engine surge could prove most 

valuable. Furthermore, a method of distinction between recoverable and non-recoverable events for the 

power loss symptom identifier was identified as being potentially valuable in preventing ICR events. The 

definitions of recoverability related to surge from the 5.1 report are provided below. [2]

Recoverable Surge: The engine is able to return to commanded power (thrust) with 

either the engine control logic or crew intervention 

Non-Recoverable Surge: An engine surge event, after which the engine is NOT able to 

return to commanded power (thrust) with either the engine control 

logic or crew intervention. Typically, the engine runs down to a 

state where it is producing minimum or no power (thrust), i.e. 

windmilling.

Report Organization 

This report provides a description of the Matlab/Simlink surge detection and recovery algorithm 

is provided. In the final section of the report, generalizations, conclusions and recommendations 

based on all data sets are made. Appendices, categorized by engine type, will contain

supporting plots not directly relevant to the main body content. 

E-5
Required Parameters 

The following is a practical set of parameters that have been identified for enabling enhanced surge 

awareness and surge recoverability. The first seven categories of parameters should be made available at 

greater than or equal to 2 Hz sampling rates. The essential set of parameters are denoted and are those 

required for the Surge Detection and Recoverability Algorithm developed under this program and 

discussed next. It should be noted that this set only applies to high-bypass turbofan engines with 

FADECs. Different parameters and sampling rates may be best for other engine types with or without 

FADECs. 

Figure 1 – Parameter set 

Surge Detection and Recoverability 

A Matlab/Simulink program was created to embody the general premise for enhanced surge detection and

recoverability determination developed under this study. This premise is that key parameters/features 

such as XNHDOT (the derivative of core speed) and P25DOT, P3DOT should normally lag TRA and gas 

path bleeds. Since in a surge event a compressor is in an unstable dynamic state, changes to the key 

parameters are expected to lead TRA or bleeds and be uncorrelated to them within a certain time buffer. 

Hence, two surge detection modules were created in the generic Matlab/Simlink program called SEDRA 

(Surge Event Detection and Recovery Analysis) the results of which are fused together. The first module 

independently considers limit exceedences of XNHDOT and P25DOT, P3DOT depending on the 

available data. The second module considers a zero lag cross correlation between the aforementioned 

parameters where the cross correlation function is defined as: 

C(m) = E[A(n+m)*conj(B(n))] = E[A(n)*conj(B(n-m))] 

Where: 

C(m) is the cross correlation for lag m, E is the expected value operator, and A and B are the discrete 

signals. Postprocessing normalizes the sequence so the autocorrelations at zero lag are identically 1.0 

forcing the zero lag cross correlation between 0 and 1.

One important aspect of the surge detection scheme is the use of time buffers in which a positive 

indication of during the buffer window is held on for fusion. A surge detection is only called out when 

E-6
the limits and cross correlation “fire” in their respective time windows. A top-level view of the surge 

detection module is given in Figure 2.

The Recoverability module in the SEDRA program is triggered only if a surge is detected. It operates in 

much the same fashion as the surge detection except that it waits for XNHDOT and P3DOT, P2.5DOT to 

respond normally to TRA and Bleed meaning that the engine is back in control. In addition, the 

recoverability scheme looks for fail-low-power characteristics such as XNH being at sub-idle for TRA at 

the idle setting. 

Because vibration was not included for all data sets and was not included in the SEDRA program. It is 

believed that vibration would add a further level of robustness to the module forming it into the 

framework shown in Figure3. 

The Readme file for SEDRA is included in the Appendix of this report describing the usage of the 

program in detail. SEDRA V1.0b has been included as a deliverable with this final report. 

Figure 2 – Surge detection module 

E-7
Figure 3 – Overall SEDRA scheme 

SEDRA detected the surge events correctly for the first, second and third data sets, however, the limit 

settings had to be decreased for the third data set to detect the event. It is unclear as to the extent that 

decreasing this setting will yield false alarms over all possible normal operating conditions. The

recoverability of the surge event was determined by SEDRA in 3-6 seconds and was correct in all three 

cases. It should be noted that validation on one non-recoverable surge event is not sufficient to validate 

the algorithm as a whole. 

 

Conclusions 

The following generalized conclusion were drawn from this study in accordance with the Task 

objectives: 

• For high bypass turbofan engines with digital controls, existing surge detection 

schemes initiate TRA and bleed valve response in <0.25 seconds. This 

intervention diminishes observability of the engines natural response during a 

surge event and to some extent diminishes the observability of the underlying 

“health” of the engine. 

• An algorithm for determining the recoverability of a surge event may be feasible 

but more recoverable/non-recoverable surges should be analyzed. Such an 

algorithm would require the parameter set given in the “Parameter Requirements” 

section of this report with a minimum of a 2 Hz sampling rate for the 1st eleven 

parameters. It would focus on the correlation of gas path parameters to TRA and 

bleeds. 

• The confidence and false alarm rate of surge detection and recoverability 

algorithms could be improved by fusing lead/lag relationships and limits on 

broadband and tracked order vibration, P3,or P25, XNHDOT, TRA and bleed 

valve positions. This approach was demonstrated in the SEDRA program. 

• There is currently no evidence that surge events can be predicted greater than a 

fraction of a second before it takes place with existing instrumentation (see 

discussion) based on data sets analyzed. However, the relative risk of surge for 

the subclass of surge events instigated by cycle deterioration or design limits may 

be determinable with a health management process for trending gas path features 

(EGT, PR vs. airflow etc.). 

E-8
Discussion 

The conclusions drawn from this analysis are based on a small sample of data sets that represent surge 

events and gas turbine theory. The general conclusions should be tested against a broader set of surge 

events that do not necessarily have to be data-rich before they should be implemented as premises for 

engine health management algorithms designed for providing potential flight deck annunciations. Data 

sets containing surge events on non-FADEC engines would also be valuable for characterizing the 

variability in surge events and observing raw engine response. 

A significant body of research is available on compressor surge precursors and suppression with active 

control schemes [8,9,10]. One such precursor is high frequency P3 pressure waves coupled with a realtime lumped parameter state space compressor model. It is the authors’ opinion that this technology is 

still relatively high risk and the robustness and cost/benefit of the sensor upgrades is suspect. 

References 

1) AIA/AECMA Project Report on Propulsion System Malfunction Plus Inappropriate Crew 

Response (PSM+ICR), Volume 2, 1 November 1998 

2) Iverson, Mesick, Task 5.1 report 

3) From correspondence with Gene Iverson, Jacob Mesick related to flight test logs 

4) Impact report P223-01-2, “Stall/Surge Risk Assessment for the 777” 1/7/02 

5) McKenzie, Axial Flow Fans and Compressors, 1997, Ipswitch Publishing Co. 

6) Walsh, Gas Turbine Performance, 1998, ASME Press 

7) Proakis, J., Digital Signal Processing, Principles, Algorithms and Applications, Prentice Hall 3rd 

edition

8) Willems, F., “Modeling and Bounded Feedback Stabilization of Centrifugal 

Compressors”, Technische Universiteit Eindhoven, ISBN 90-386-2931-1 

9) Yeung, “Non-linear control of Rotating stall and surge with Axisymmetric Bleed and Air 

Injection on Axial Flow Compressors”, California Institute of Tech. 1999 

10) Krichene, Prasad, et. al. “Stall and Surge Control of Compressors Using Real Time

Precursor Identification”, American Institute of Aeronautics and Astronautics, 2000 

NOTES 

Surge subcategories – Taken from Report 5.1 

The first sub-category is a surge from cycle deterioration or more generally current cycle. This is a 

characterization that could be put on an engine that has been in service for some time and is deteriorated 

to the point where the stall margin is no longer sufficient to continue operating without surging. However, 

a relatively new engine may fall into this category if, for example, it is a poor performer from the 

production line (low on the production acceptance chart) and it runs into enough unusual but not 

uncommon operating conditions that the stall margin is depleted 

E-9
The second sub-category is hardware / software malfunction. This is easy in the case of hardware 

- some part broke. It is not as easy to define for software (and for some hardware failures) and

leads to the possible third category - design limits. 

The design limits sub-category would be for a cycle that is closer to its stall margin than

expected because production variation affects the operating line more than expected, stator vane 

schedules are too demanding, stability bleed system mechanical performance varies, stator vanes 

are mis-rigged, bleed scheduling is over/under-active, etc. 

Characterizations of surge from PSM+ICR report – Taken from Report 5.1 

The report listed engine parameter effects of a compressor surge as a rapid decrease in rotor 

speeds, pressures, and fuel flow, and typically an increase in EGT. The report provides some

ranges of variation of these engine parameters as follows. 

EPR/Burner Pressure 60% - 90% drop to coincide with bang sound 

XNL 15% - 40% drop to coincide with bang sound 

XNH 5% - 10% drop to coincide with bang sound 

EGT 10 – 20 deg/sec rise 

SEDRA V1.0b Readme File 

SEDRA is Matlab/Simulink/Stateflow program for evaluating flight test data files for 

surge events and determining if the surge event was recoverable or not. 

The program is split into 2 main sections 1) Surge Event Detection and 2) Recoverability determination. 

Surge detection is basically performed by looking at the behavior of HPC pressure, and XNH (plus their 

derivatives) with respect to TRA and Bleed valve positions or flows over a time buffer. If a surge event is 

detected, the recoverability algorithm becomes activated and observes the response of HPC pressure and 

speed to FADEC or crew intervention to the event over a time buffer. Currently, it specifically focuses on 

failure to low power. 

To run the program: 

1) Open Matlab 6.1 R12 or greater with Simulink and Stateflow 

2) Run SurgeInit_a.m (This program will load up all constants, selects a data file, and sets

the available parameters and sampling rates) The m-file is configured to load the data

from third engine flight test which contained a non-recoverable surge event. 

3) Open SurgeDetection040402.mdl 

4) Double click into “Surge Detection Algorithm” and click on the “run” arrow 

5) Open any or all of the scopes provided to see intermediate results. 

6) Open the “Result” scope to see the final surge detection result. 

7) Open the “Recoverability Detection Algorithm” and inspect the scope on the far right to

see that the program determined that surge was non-recoverable (value of 1). 

8) To see a contrasting case, open the SurgeInit_a.m file and change line 30 from “load 

DataE3” to “load DataE2”, save and run 

9) Note that even though this is a very similar operational event no surge is detected. 

E-10
APPENDIX F—AIRPLANE ENGINE INDICATIONS

F-1
Appendix F. Airplane Engine Indications 

737-200 

Figure F-1. Discrete/Dedicated Mechanical Engine Instruments - Boeing 737–200

F-2
737-300/400/500 

Figure F-2. Liquid Crystal Display (LCD) Engine Indications - Boeing 737–300/400/500 

F-3
737-600/700/800/900 

Figure F-3. Display Based Engine Indications - Boeing 737–600/700/800/900 

Figure 5 illustrates 737 Next Generation Primary Engine Indications (1), Fuel Quantity 

Indications (2), Secondary Engine Indications (3), and Hydraulic Indications (4) 

displayed on the upper center engine indications display. Two main configurations are 

possible: 1) The side-by-side configuration shown in Figure 3, and 2) An Over-Under 

configuration similar to the EICAS airplane implementations on 747-400, 757, 767, and 

777 models. 

F-4
777 

Primary Engine Indications 

Secondary Engine Indications 

Figure F-4. Display Based Engine Indications - Boeing 777-200/300

F-5
Indication Features/Enhancements and Annunciations 

Engine indication features or enhancements are provided to reduce crew integration 

activity and thereby reduce crew workload. Features and enhancements generally 

involve collocation and presentation of related information (e.g., commanded and actual 

state information), presentation of control target and system limit indications, and other 

elements and implementations that integrate data into information. Engine indication 

annunciations are provided to support crew detection of non-normal conditions. 

Annunciations generally involve color coding, flashing, and other implementations that 

call attention to a particular indication or feature. Engine indication features, 

enhancements, and annunciations are designed to make it easier and quicker for the user 

to obtain relevant or necessary information. 

737-200 Thrust Setting Parameter 

Figure F-5. 737-200 Engine Pressure Ratio (EPR) Indicator

Engine Pressure Ratio (EPR) is the primary thrust setting reference on 737-200. Figure 5 

illustrates the 737-200 EPR Indicator. Flag 2 EPR Reference Selector. ROTATE – 

Positions the EPR reference “bug” and changes the reference EPR digital readout in the 

lower window correspondingly. When the reference selector is pushed in, the lower 

digital window and “bug” will be set by an input signal from the Performance Data 

Computer (PDC). 

F-6
737-300/400/500 Thrust Setting Parameter 

Figure F-6. 737-300/400/500 Engine Fan Speed (N1) Indicator

1 N1 Manual Set Indication. Set by N1 manual set knob. Blank when manual set knob 

is pushed in. 

2 N1 RPM Indication (green). Displays N1 % RPM. 

3 Reference N1 Bug (yellow). With N1 manual set knob pushed in it is positioned by 

FMC, based on N1 limit page and takeoff reference page, and displays active N1 limit for 

A/T operation. 

With N1 manual set knob pulled out it displays crew selected N1 limit, and has no effect 

on A/T operation. 

4 Warning Light. Illuminated (red) it indicates the N1 limit has been reached or 

exceeded, and remains illuminated until N1 is reduced below the limit. 

5 N1 Red Radial. Shows N1 % RPM operating limit. 

6 N1 RPM Readout (digital). Displays N1 % RPM. 

737-600/700/800/900 Thrust Setting Parameter 

Figure F-7. 737-NG Engine Pressure Ratio (EPR) Indication 

F-7
1 N1 SET Outer Knob 

AUTO – Both reference N1 bugs set by FMC based on N1 limit page and takeoff 

reference page. Displays reference N1 bugs at active N1 limit for A/T. 

BOTH – Both reference N1 bugs and readouts manually set by turning N1 SET inner 

knob. Has no effect on A/T operation. 

1 or 2 – Respective N1 reference bug and readout manually set by turning N1 SET inner 

knob. Has no effect on A/T operation. 

2 N1 SET Inner Knob (spring-loaded to center). Rotate – positions reference N1 

bug(s) and readouts when N1 SET outer knob is set to BOTH, 1, or 2. 

3 Reference N1 Bugs. Displayed (green) – with N1 SET outer knob in AUTO, 1, 2 or 

BOTH position. 

4 N1 Redlines. Displayed (red) – N1% RPM operating limit 

5 N1 Command Sectors. Displayed (white) – momentary difference between actual N1 

and value commanded by thrust lever position. 

6 N1 RPM Readouts (digital). Displayed (white) – normal operating range. Displayed 

(red): 

• operating limit exceeded 

• on ground after engine shutdown, red box indicates an inflight exceedance has occurred. 

7 Reference N1 Readouts. Displayed (green) – manually set N1% RPM: 

• set with N1 SET inner knob when N1 SET is in BOTH, 1, or 2 position 

• blank when N1 SET outer knob in AUTO position 

• – – – – when N1 SET outer knob in Auto and FMC source invalid. 

8 N1 RPM Indications. Displays N1% RPM: 

• displayed (white) – normal operating range 

• displayed (red) – operating limit exceeded. 

777 THRUST SETTING PARAMETER 

Engine Pressure Ratio (EPR) is the primary thrust setting reference on 777 airplanes with 

PW and RR engines. On 777 PW and RR engines, N1 is the alternate thrust setting 

reference in certain Electronic Engine Control (EEC) modes of operation. Similar EPR 

and N1 indications are implemented on other EICAS airplanes. The following 

paragraphs describe EPR and N1 indications on 777 PW and RR engines. 

F-8
Figure F-8. 777 Engine Pressure Ratio (EPR) Indication [PW, RR Engines]

1 Maximum EPR Line. Displayed (amber). 

2 Reference/Target EPR indication. Displayed (green) – reference EPR limit. 

Displayed magenta – target FMC commanded EPR when VNAV is engaged and the 

autothrottle is engaged in THR or THR REF mode, or the autothrottle is not engaged. 

3 Commanded EPR. Displayed (white). 

4 Commanded EPR Sector. Displays momentary difference between engine EPR and 

EPR commanded by 

thrust lever position. 

5 Reference EPR. Displayed (green). 

6 Actual EPR. Displayed (white). 

7 Actual EPR indication. Displayed (white). Note: When reverse thrust is activated,

maximum EPR line, commanded EPR, reference/target EPR indication, and reference 

EPR are not displayed: 

F-9
777 Fan Speed (N1) Parameter 

Figure F-9. 777 Engine Fan Speed (N1) Indication [PW, RR Engines]

1 N1 Red Line. Displayed (red) – N1 RPM operating limit. 

2 N1. Digital N1 RPM (%), displayed: • (white) – normal operating range. • (red) –

operating limit reached.

3 N1 Indication. N1 RPM, displayed: • (white) – normal operating range. • (red) – 

operating limit reached.

Figure F-10. 777 . Hard Alternate Mode Engine Fan Speed (N1) Indication. [PW, RR 

Engines]

1 N1 Red Line. Displayed (red). 

2 Reference/Target N1 Indication. Displayed (green) – reference N1 limit. Displayed 

(magenta) – target FMC commanded N1 when VNAV is engaged and: • the autothrottle 

is engaged in THR or THR REF mode, or • the autothrottle is not engaged. 

F-10
3 Commanded N1 Sector. Displays momentary difference between engine N1 and N1 

commanded by thrust 

lever position. 

4 Maximum N1 Line. Displayed (amber). 

5 Reference N1. Displayed (green) – thrust reference calibrated for N1. 

Note: When reverse thrust is activated, maximum N1 line, commanded N1, 

reference/target N1 indication, and reference N1 indications are not displayed. 

F-11
Fan Speed (N1) is the primary thrust setting reference in all modes of operation on 777 

airplanes with GE engines. Similar N1 indications are implemented on other EICAS 

airplanes. The following paragraphs describe N1 indications on 777 GE engines. 

Figure F-11. 777 Engine Fan Speed (N1) Indication. [GE Engines]

1 N1 Red Line. Displayed (red) – N1 RPM operating limit. 

2 Reference/Target N1. Displayed (green) – reference N1 limit. Displayed (magenta) – 

target FMC commanded N1 when VNAV is engaged and: • the autothrottle is engaged in 

THR or THR REF mode, or • the autothrottle is not engaged. 

3 Commanded N1. Displayed (white). 

4 Commanded N1 Sector. Displays momentary difference between engine N1 and N1 

commanded by thrust 

lever position. 

5 Maximum N1 Line. Displayed (amber). 

6 Reference N1. Displayed (digital, green). 

7 N1. Digital N1% RPM, displayed: • (white) – normal operating range, • (red) – 

operating limit reached.

8 N1 Indication. N1 RPM, displayed: • (white) – normal operating range, • (red) – 

operating limit reached.

Note: When reverse thrust is activated, maximum N1 line, commanded N1, 

reference/target N1 indication, and reference N1 indications are not displayed: 

F-12
ENGINE INDICATION ANNUNCIATIONS

737-NG 

N1 RPM Readouts (digital). Displayed (red): • operating limit exceeded, • on ground 

after engine shutdown, red box indicates an inflight exceedance has occurred. 

N1 RPM Indications. displayed (red) – operating limit exceeded. 

777 PW, RR, AND GE 

N1. Digital N1 RPM (%), displayed: • (red) – operating limit reached. 

N1 Indication. N1 RPM, displayed: • (red) – operating limit reached. 

777 PW and RR: ?EPR. No exceedences or conditions currently annunciated or alerted.? 

Thrust Reverser (REV) Indications 

Figure 13 illustrates 737NG reverse thrust indications displayed on the primary engine 

indication display. REV is displayed in amber when the thrust reverser is moved from 

stowed position. REV REV is displayed in green when the thrust reverser is deployed. 

The 737 REV indications are representative of such indications on Boeing EICAS aircraft 

(747-400, 757, 767, and 777). 

Figure F-12. 737 Reverse Thrust Indications

737NG Engine Fail (ENG FAIL) Alert 

Displayed (amber): • engine operating below sustainable idle (less than 50% N2); and •

engine start lever in IDLE position. Alert remains until: • engine recovers; or • start 

lever moved to CUTOFF; or • engine fire warning switch pulled. As previously noted 

737 model aircraft do not have a display based centralized alerting system. 737 system 

failure indications are provided by discrete alert lamps and display indications. 

Figure F-13. ENG FAIL Indication

F-13
Automatic Display of Secondary Engine Indications 

737 Secondary engine indications are automatically displayed when: • CDS initially 

receives power, • selected by the Multi-Function Display (MFD), • in flight when an 

engine start lever moved to CUTOFF, • in flight when an engine fails, or • when a 

secondary engine parameter exceeds normal operating range.

The 777 and other EICAS airplane secondary engine indications are automatically 

displayed when: • the displays initially receive electrical power, • a FUEL CONTROL 

switch is moved to CUTOFF in flight, • an engine fire switch is pulled in flight, • a 

secondary engine parameter is exceeded, or • engine N2 or N3 RPM is below idle in 

flight. 

777 

The oil temperature vertical indication has caution ranges displayed by amber bands. If 

oil temperature reaches the caution range, the digital readout, digital readout box, and 

pointer all change color to amber. 

The oil temperature and oil pressure vertical indication has caution ranges displayed by 

amber bands. If oil temperature or oil pressure reaches the caution range, the digital 

readout, digital readout box, and pointer all change color to amber. 

N1, N2, N3, EGT, oil pressure, and oil temperature indications have operating limits 

indicated by red lines. If one of these indications reaches the red line, the digital readout, 

box, and pointer change color to red for that indication. Note: If an N1, N2, N3, or EGT 

red line is exceeded, the box enclosing the digital readout remains red after the exceeded 

limit returns to the normal range. The red box color can be canceled to white or recalled 

to red by pushing the cancel/recall switch on the display select panel. An indication 

changes color back to white when it returns to the normal operating range. 

The EGT indication has a maximum takeoff limit displayed by a red line. If EGT reaches 

the maximum takeoff limit, the digital indication, box, pointer and dial, all change color 

to red. 

For low oil quantity, the oil quantity digital readout changes to black text on a white 

background. The white text LO is displayed adjacent to the readout. 

For high engine vibration, the vibration digital readout changes to black text on a white 

background. 

777 Compact Display Format 

In compact format, primary and secondary engine indications are combined on the same

display.

F-14
[PW Engines] The EPR and N1 displays are the same as the normal displays. All other 

indications change to digital readouts only. If an amber or red line parameter for a digital 

indication is exceeded, the digital indication changes color to amber or red (as does the 

box that appears around an EGT, or N2 indication for a red line exceedance). If the EGT 

or N2 red line is exceeded, the red color of the box around the digital indication can be 

returned to white (if the exceeded parameter has returned to normal) by pushing the 

display select panel CANCEL/RECALL switch. 

[GE Engines] The N1 and EGT indications are displayed as they are normally (moving 

pointer/round dial and digital indications). All other indications change to digital readouts 

only, with the exception that the N2 digital readout is boxed if a parameter is exceeded. If 

an amber or red line parameter for a digital indication is exceeded, the digital indication 

changes color to amber or red (as does the box that appears around the N2 indication for 

a red line exceedance). If the N2 red line is exceeded, the red color of the box around the 

digital indication can be returned to white (if the exceeded parameter has returned to 

normal) by pushing the display select panel CANCEL/RECALL switch. 

[RR Engines] The EPR and N1 displays are the same as the normal displays. All other 

indications change to digital readouts only. If an amber or red line parameter for a digital 

indication is exceeded, the digital indication changes color to amber or red (as does the 

box that appears around an EGT, N2, or N3 indication). If the N1, N2, N3, or EGT red 

line is exceeded, the red color of the box around the digital indication can be returned to 

white (if the exceeded parameter has returned to normal) by pushing the display select 

panel CANCEL/RECALL switch. 

Primary and secondary engine indications are displayed on EICAS in compact format 

whenever: 

• secondary engine display is automatically selected, and the lower multifunction display 

is failed, unpowered, or is occupied, or 

• secondary engine display is manually selected to the lower center MFD and the lower 

MFD is failed, unpowered, or occupied with EICAS. 

F-15/F-16
APPENDIX G—FLIGHT DECK DESIGN AND OPERATIONAL PHILOSOPHY

G-1
Appendix G. Applicable Flight Deck Design & 

Operational Philosophy, Requirements, & Guidelines 

The following paragraphs document selected generalized Flight Deck design and 

operational philosophies, and interface design requirements and guidelines applicable to 

transport category commercial airplanes. These selected objectives, guidelines, and 

requirements, are applicable to the design and development of Flight Deck controls, 

indications, and annunciations in general, and engine related indications and 

annunciations in particular. The objectives, guidelines, and requirements are also 

relevant to the operational assessment of new indications and annunciations designed to 

prevent or reduce engine malfunction related undesired crew response, and are a basis for 

the conclusions and recommendations herein. The objectives, guidelines, and 

requirements are provided to aid in understanding how report conclusions and 

recommendations are reached. 

Flight Deck Design & Operational Philosophy 

The following paragraphs are selected generalized Flight Deck Design and Operational 

Philosophy. These excerpts, in the form of objectives and guidelines, are applicable to 

the design and development of engine indications and annunciations, are relevant to the 

operational assessment of new indications and annunciations, and are a basis for the 

conclusions and recommendations herein. 

System designs should adhere to proven design concepts of simplicity, fault tolerance, 

error tolerance, and appropriate use of redundancy and automation. 

Human engineering design principles should be used, and human factors considered, as 

part of the Flight Deck interface design process. 

Human engineering principles should be used to provide a safe, efficient, and 

comfortable, working environment. 

Systems design should correlate with Flight Crew Training philosophy. 

System control and display information should be as simplified as possible. 

Controls and displays should, to the extent possible, be co-located and grouped according 

to operational function. 

Related display information should be integrated into a single consistent format 

compatible with operational usage. 

For flight essential functions, supplemental information, which clarifies or reinforces the 

normal indications of functional operations, should be provided. 

Minimization of the effect of crew errors should be an integral part of the design. 

G-2
Quiet, Dark Flight Deck Philosophy - Alerting indications should not be presented for 

normal operation. 

Alerting should be implemented based on a demonstrable need for crew awareness or 

action, and minimal risk of inappropriate or undesired crew distraction, response or 

desensitization. 

Flight crews should be alerted to non-normal operational and system conditions 

according to the severity of the condition and the criticality of flight crew awareness and 

response time. 

Alert presentations must not degrade flight operations. 

System failure responses may be automated when the response is: 

• Invariant regardless of circumstance 

• Consistent or compatible with pilot expectations 

• Reversible, and 

• Has no consequential effects which directly interfere with other pilot tasks.

The operational hierarchy, listed in order of importance to Flight Safety is: 

• Flight path control 

• Navigation/Guidance, 

• Aircraft separation 

• Communication, and 

• System operation 

Flight Deck design should optimize pilot workload 

• Design should allow pilots to focus on total flight operations rather than on 

subsystem monitoring, control, troubleshooting, or problem solving. 

• Too little or too much workload should be avoided. 

• Pilot memory requirements should be minimized 

• The number, difficulty, and time allowed for tasks should be considered. 

• Complex procedures should not be used to compensate for non-optimized systems 

design. 

• Design should provide flexibility to allow pilots to manage workload across 

functions, flight phases, and individual differences. 

Normal and non-normal procedures should encourage and facilitate crew coordination. 

With respect to flight control and automation, the pilots should have final authority. 

With respect to decision-making, the Captain has the final authority, but both pilots are 

responsible for the safe operation of the airplane. 

G-3
Flight Deck Interface Design Guidelines and Requirements 

The following paragraphs contain selected generalized Flight Deck interface design 

requirements and guidelines applicable to the development of engine indications and 

annunciations applicable to transport category commercial airplanes. These requirements 

and recommendations are also relevant to the operational assessment of new indications 

and annunciations, and are a basis for the conclusions and recommendations herein. 

Primary flight and thrust controls must incorporate visual and tactile feedback to the 

flight crew 

Systems controls and displays should be labeled according to their actual function within 

the system. 

Controls and displays must be consistent in operation, information coding, operator 

feedback, and appearance. 

Wherever possible, controls and displays must be equally accessible to both pilot 

locations such that either pilot may accomplish the Pilot Flying and the Pilot Not Flying 

duties, and carry out Captain and First Officer responsibilities. 

Each pilot must be able to see and read all in-flight required non-duplicated instruments 

and control panels. 

Switches, controls, and essential displays must be distinguishable under all probable 

cockpit lighting conditions, and must provide clear and unambiguous information or 

status. 

Displays or annunciators presenting dynamically changing information required to be 

read for immediate understanding must have nomenclature which subtends a minimum of 

xx minutes of visual arc as measured from the Flight Deck Eye Reference Point (ERP). 

Individual displays or annunciators presenting alerting or dynamic information must have 

nomenclature which subtends a minimum of xx minutes of visual arc as measured from

the Flight Deck Eye Reference Point (ERP) unless it can be otherwise demonstrated that 

alternative means provide sufficient information. 

The minimum visual angles specified can be reduced by xx% for electronic display 

symbols. Electronic display symbols must subtends at least of xx minutes of visual arc as 

measured from the Flight Deck Eye Reference Point (ERP). 

Airplane retrofits should be implemented in a manner consistent with existing best 

practices, the certification basis of the airplane, and in a manner consistent or compatible 

with the specific airplane flight deck design and interface being retrofit. The feasibility 

of retrofit should be considered. 

Alerting indications should not be presented for normal operation (Quiet, Dark Flight 

Deck). 

G-4
The crew must be alerted to unsafe operating conditions to enable appropriate corrective 

action to be taken. 

The consequences of false or nuisance alerting should be assessed, and the potential for 

false or nuisance alerting must be minimized. 

The consequences of failure to alert must be assessed, and the potential for failure to alert 

should be minimized. 

Alert presentations must provide combinations of visual, aural, or tactile elements to 

attract attention and define the alert condition sufficiently for appropriate crew action or 

awareness. 

Alert conditions must be indicated on the forward panels such that determination of when 

to take action can be made by the pilot without further reference. 

All non-voice aural alert annunciations must be accompanied by a visual annunciation 

which defines the alert condition. 

Alert conditions should be presented as one of the following alert levels: 

• Time Critical Warning – An operational condition which requires immediate pilot 

and immediate corrective or compensatory action to maintain safe flight 

• Warning - An operational or aircraft system condition which requires immediate 

crew awareness and timely corrective or compensatory action.

• Caution - An operational or aircraft system condition which requires immediate 

crew awareness. Corrective or compensatory action may be required. 

• Advisory- An operational or aircraft system condition which requires crew

awareness. Corrective or compensatory action may be required. 

A master aural annunciation unique to each alert level must be provided for all time 

critical warning, warning, and caution level alerts. 

Alert annunciations must automatically clear when the alert condition no longer exists. 

System controls, and associated monitoring and alerting, must be designed to minimize 

the probability of crew error which could create additional hazards following a failure.

System information should be automatically displayed, or readily available, when the 

information is required to assess a failure or take action. 

G-5
Applicable Federal Aviation Regulations (FARs) 

FAR 25-1305 Powerplant Instruments

FAR 25-1305 documents FARs applicable to Powerplant Instruments. The following 

applicable requirements are excerpted from 25-1305. The following FAR 25-1305 

excerpts document required powerplant instruments applicable to this operational 

assessment: 

25-1305 (a) For all airplanes. (1) A fuel pressure warning means for each engine, or a 

master warning means for all engines with provision for isolating the individual warning 

means from the master warning means. 

25-1305 (c) For turbine engine-powered airplanes. 

(1) A gas temperature indicator for each engine. 

(2) A fuel flowmeter indicator for each engine. 

(3) A tachometer (to indicate the speed of the rotors with established limiting speeds) for 

each engine. 

25-1305 (d) For turbojet engine powered airplanes 

(1) An indicator to indicate thrust, or a parameter that is directly related to thrust, to the 

pilot. The indication must be based on the direct measurement of thrust or of parameters 

that are directly related to thrust. The indicator must indicate a change in thrust resulting 

from any engine malfunction, damage, or deterioration. 

(2) A position indicating means to indicate to the flight crew when the thrust reversing

device is in the reverse thrust position, for each engine using a thrust reversing device. 

(3) An indicator to indicate rotor system unbalance. 

FAR 25.1309 Equipment, systems, and installations. 

(a) The equipment, systems, and installations whose functioning is required by this 

subchapter, must be designed to ensure that they perform their intended functions under 

any foreseeable operating condition. 

(b) The airplane systems and associated components, considered separately and in 

relation 

to other systems, must be designed so that -- 

(1) The occurrence of any failure condition which would prevent the continued safe flight 

and landing of the airplane is extremely improbable, and 

(2) The occurrence of any other failure conditions which would reduce the capability of 

the 

airplane or the ability of the crew to cope with adverse operating conditions is 

improbable. 

(c) Warning information must be provided to alert the crew to unsafe system operating

conditions, and to enable them to take appropriate corrective action. Systems, controls, 

and associated monitoring and warning means must be designed to minimize crew errors 

which could create additional hazards. 

(d) Compliance with the requirements of paragraph (b) of this section must be shown by 

G-6
analysis, and where necessary, by appropriate ground, flight, or simulator tests. The 

analysis must consider -- 

(1) Possible modes of failure, including malfunctions and damage from external sources. 

(2) The probability of multiple failures and undetected failures. 

(3) The resulting effects on the airplane and occupants, considering the stage of flight and 

operating conditions, and 

(4) The crew warning cues, corrective action required, and the capability of detecting 

faults. 

Advisory Circular Guidance 

AC 20-88A provides guidelines on the marking of aircraft powerplant instruments and 

electronic displays (cathode ray tubes, etc.). 

4. b. Powerplant instruments (displays) may be electromechanical, mechanical, or

electronic indicators. 

5. e. The color red indicates an operating condition beyond authorized limits and requires 

a specific action on the part of the flightcrew. The specific action to be taken should be 

described in detail in the Airplane/Rotorcraft Flight Manual. 

5. f. The color green is used to indicate a normal condition for operation, both ground and 

flight. 

5. g. The color yellow is used to indicate either a takeoff or cautionary range where 

limited operation is permissible as directed by the 

applicable Airplane/Rotorcraft Flight Manual. 

6. d. The advent of the CRT display allows greater flexibility in the design of instrument 

marking schemes. A concept has been developed where normal engine operating 

conditions are not identified and only abnormal conditions are designated by colored 

markings. If all abnormal conditions are adequately indicated by specific design features, 

green markings are unnecessary based on a finding of equivalency. Yellow and red 

markings are used but may be subdued until the parameter being monitored reaches the 

caution or warning value. At that time the respective color is highlighted in some manner 

to alert the flightcrew. 

AC 25-11 provides guidance for certification of cathode ray tube (CRT) based electronic 

display 

systems used for guidance, control, or decision-making by the pilots of transport category 

airplanes. The AC states in paragraph 4.a. “The use of electronic displays allows 

designers to integrate systems to a much higher degree than was practical with previous 

airplane flight deck components. With this integration can come much greater simplicity 

of operation of the airplane through automation of navigation, thrust, airplane control, 

and the related display systems.”. 

4.a.3.ix. Propulsion, System Parameter Displays. 

5. INFORMATION SEPARATION 

a. Color Standardization. 

b. Color Perception vs. Workload. 

c. Standard Symbology. 

d. Symbol Position. 

e. Clutter. 

G-7
f. Attention-Getting Requirements. (1) Some electronic display functions are 

intended to alert the pilot to changes: navigation sensor status changes (VOR 

flag), computed data status changes (flight director flag or command cue 

removal), and flight control system normal mode changes (annunciator changes 

from armed to engaged) are a few examples. For the displayed information to be 

effective as an attention-getter, some easily noticeable change must be evident. A 

legend change by itself is inadequate to annunciate automatic or uncommanded 

mode changes. Color changes may seem adequate in low light levels or during 

laboratory demonstrations but become much less effective at high ambient light

levels. Motion is an excellent attention-getting device. Symbol shape changes are 

also effective, such as placing a box around freshly changed information. Shortterm flashing symbols (approximately 10 seconds or flash until acknowledge) are 

effective attention-getters. A permanent or long-term flashing symbol that is 

noncancellable should not be used. 

6. DISPLAY VISUAL CHARACTERISTICS. e. Dynamics. 

7. INFORMATION DISPLAY. Display elements and symbology used in real-time 

"tactical" airplane control should be natural, intuitive, and not dependent on training or 

adaptation for correct interpretation.

h. Full-Time vs. Part-Time Displays. 

10. INTEGRATED WARNING, CAUTION AND ADVISORY DISPLAYS. 

G-8